Bug 2482406 (CVE-2026-44660)

Summary: CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, aprice, bbrownin, eglynn, ehelms, ggainey, jjoyce, jkoehler, jpretori, jsamir, jschluet, juwatts, jwong, kshier, lhh, lphiri, mburns, mgarciac, mhulan, nmoumoul, oezr, omaciel, osousa, pcreech, rchan, rjohnson, smallamp, stcannon, teagle, tmalecek, ttakamiy
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in UltraJSON, a fast JSON encoder and decoder. When the `ujson.dump()` function attempts to write data to a file-like object and an error occurs during this operation, the memory allocated for the serialized JSON string is not properly released. This continuous failure to deallocate memory can lead to a memory leak, potentially causing resource exhaustion and a Denial of Service (DoS) for the affected system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2486951, 2486952, 2486949, 2486950    
Bug Blocks:    

Description OSIDB Bzimport 2026-05-27 21:02:09 UTC 
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.