What is CVE-2026-44660?

CVE-2026-44660 is a high-severity vulnerability in Ultrajson, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 7.5/10. Published 2026-05-27.

How severe is CVE-2026-44660?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Ultrajson

CVE-2026-44660

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.

Published 2026-05-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.006 (48.8th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.006 · change: +0.002

Affected products

Ultrajson — versions < 5.12.1
Ultrajson Project

Weakness classification (CWE)

CWE-401 — Missing Release of Memory after Effective Lifetime

References

github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg (Exploit, Patch, Mitigation, Vendor Advisory)
github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9 (Patch)
github.com/ultrajson/ultrajson/releases/tag/5.12.1 (Product, Release Notes)

Frequently asked questions

What is CVE-2026-44660?: CVE-2026-44660 is a high-severity vulnerability in Ultrajson, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 7.5/10. Published 2026-05-27.
How severe is CVE-2026-44660?: High severity. CVSS v3 base score is 7.5 out of 10.