CVE-2026-44660
Last modified
CVE-2026-44660 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ultrajson Project | Ultrajson | < 5.12.1 |
References
- https://github.com/ultrajson/ultrajson/releases/tag/5.12.1Product, Release Notes
- https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xgExploit, Mitigation, Patch, Vendor Advisory
- https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xgExploit, Mitigation, Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-44660?
How severe is CVE-2026-44660?
How do I fix CVE-2026-44660?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-44655Mantis Bug Tracker (MantisBT) is an open source issue tracke…8.6
- CVE-2026-44656Vim is an open source, command line text editor. Prior to ve…5.3
- CVE-2026-44657Mantis Bug Tracker (MantisBT) is an open source issue tracke…7.5
- CVE-2026-44658Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed …2.4
- CVE-2026-44659Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN B…4.7
- CVE-2026-4466A vulnerability has been found in Comfast CF-AC100 2.6.0.8. …4.7
- CVE-2026-44661python-utcp is the python implementation of UTCP. Prior to 1…4.7
- CVE-2026-44662rust-openssl provides OpenSSL bindings for the Rust programm…5.1
- CVE-2026-44663OpenEXR is the reference implementation and specification fo…7.1
- CVE-2026-44664fast-xml-builder builds XML from JSON. In 1.1.5, the fix for…6.1
- CVE-2026-44665fast-xml-builder builds XML from JSON. Prior to 1.1.7, when …6.1
- CVE-2026-44666HRConvert2 is a self-hosted, drag-and-drop & nosql file conv…9.3
Are you affected by CVE-2026-44660?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST