CVE-2026-44660: UltraJSON has a Memory Leak in ujson.dump() on Write Failure
(updated )
When ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload.
Code that uses ujson.dumps() rather than ujson.dump() or only JSON load/decode methods is unaffected.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-44660 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →