Most recent entries from all

BREW-magic-wormhole-CVE-2026-44660 — UltraJSON has a Memory Leak in ujson.dump() on Write Failure

Affected: Homebrew: magic-wormhole

### Summary

When `ujson.dump()` writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload.

Code that uses `ujson.dumps()` rather than `ujson.dump()` or only JSON load/decode methods is unaffected.

### Details

**Vulnerability Location:** - `src/ujson/python/objToJSON.c:913` - `objToJSONFile()` function start - `src/ujson/python/objToJSON.c:931` - Error return on write failure - `src/ujson/python/objToJSON.c:942` - Early return without cleanup **Root Cause:**

The `objToJSONFile()` function allocates a Python string object via `ujson_dumps_internal()`, calls the file's `write()` method, and returns early if `write()` raises an exception—but never calls `Py_DECREF(string)` on the early exit path.

### PoC ```python import gc, tracemalloc, ujson

class BadFile: def write(self, s): raise RuntimeError("boom")

obj = {"x": "A" * 200000}

def run(): try: ujson.dump(obj, BadFile()) except RuntimeError: pass

run() tracemalloc.start() gc.collect() base = tracemalloc.get_traced_memory()[0]

for i in range(5): run() gc.collect() cur = tracemalloc.get_traced_memory()[0] print(i, cur - base) ```

### Impact

Any application that serializes data through `ujson.dump()` to an attacker-influenced file-like object that can fail can be driven into linear memory growth. An attacker…

EUVD-2026-323047

fkie_cve-2026-44660

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.

GHSA-c38f-wx89-p2xg — UltraJSON has a Memory Leak in ujson.dump() on Write Failure

Affected: PyPI: ujson

### Summary

Code that uses `ujson.dumps()` rather than `ujson.dump()` or only JSON load/decode methods is unaffected.

### Details

### PoC ```python import gc, tracemalloc, ujson

class BadFile: def write(self, s): raise RuntimeError("boom")

obj = {"x": "A" * 200000}

def run(): try: ujson.dump(obj, BadFile()) except RuntimeError: pass

run() tracemalloc.start() gc.collect() base = tracemalloc.get_traced_memory()[0]

for i in range(5): run() gc.collect() cur = tracemalloc.get_traced_memory()[0] print(i, cur - base) ```

### Impact

Any application that serializes data through `ujson.dump()` to an attacker-influenced file-like object that can fail can be driven into linear memory growth. An attacker…

OESA-2026-3606 — python-ujson security update

Affected: openEuler:20.03-LTS-SP4: python-ujson

UltraJSON Security Fix(es):

UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode). Exploitation can, for example, use a large amount of indentation.(CVE-2021-45958)

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries. All users parsing JSON from untrusted sources are vulnerable. From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output. Users are advised to upgrade. There are no known workarounds for this issue.(CVE-2022-31116)

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python. This issue has been resolved in version 5.4.0 and all users should upgrade to UltraJSON 5.4.0. There are no known workarounds for this issue.(CVE-2022-31117)

UltraJSON is a fast JSON encoder and decoder written in pure C wi…

openSUSE-SU-2026:21518-1 — Security update for python-ujson

Security update for python-ujson

PYSEC-2026-2293

Affected: PyPI: ujson

RHSA-2026:42644 — Red Hat Security Advisory: RHOAI 2.25.9 - Red Hat OpenShift AI

idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded transformers: code execution when processing a malicious Perceiver model file transformers: code execution when processing a malicious Transformer-XL model file transformers: code execution when processing a malicious megatron_gpt2 model file transformers: code execution when converting a malicious SEW model checkpoint transformers: code execution when converting a malicious SEW-D model checkpoint transformers: code execution when converting a malicious HuBERT model checkpoint transformers: code execution when processing a malicious X-CLIP model file transformers: code execution when processing a malicious GLM4 model file aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite keras: Keras: Arbitrary file write via path traversal in archive extraction utilities vllm: vLLM: Denial of Service via specially crafted image in multimodal model serving vLLM: vLLM: Arbitrary code execution via untrusted model loading pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID python-multipart: Python-Multipart: Arbitrary file write via path traversal vulne…

SUSE-SU-2026:23114-1 — Security update for python-ujson

Security update for python-ujson

UBUNTU-CVE-2026-44660

Affected: Ubuntu:14.04:LTS: pandas, Ubuntu:16.04:LTS: collada2gltf, Ubuntu:16.04:LTS: pandas, Ubuntu:Pro:16.04:LTS: ujson, Ubuntu:18.04:LTS: collada2gltf, Ubuntu:18.04:LTS: pandas, Ubuntu:Pro:18.04:LTS: ujson, Ubuntu:20.04:LTS: pandas, Ubuntu:Pro:20.04:LTS: ujson, Ubuntu:22.04:LTS: collada2gltf and 8 more