CVE-2026-44660: UltraJSON: Memory Leak in ujson.dump() on Write Failure

Synopsis

A memory leak vulnerability exists in UltraJSON's ujson.dump() function when writing to a file-like object. When a write operation raises an exception during serialization, the internal reference count for the serialized JSON string object is never decremented, causing the full payload size to leak for every failed write. An unauthenticated attacker able to reach the application over a network and trigger repeated write failures can exhaust process memory, leading to denial of service. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the application over a network to trigger write operations that produce the leak.

• AuthenticationNot required

  No credentials or account are needed to exploit this vulnerability; the attack is available to any network-accessible client.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the vulnerable service without any social-engineering step.

• Attack complexityDetail

  Exploit conditions are low-complexity and reliable, requiring no race conditions, special memory layout, or environmental prerequisites beyond the ability to trigger a failed write.

Blast Radius

• Crashes or destabilizes the affected Python process by exhausting available memory through repeated leaked payloads.
• Causes denial of service for all users and workloads depending on the affected service, as memory exhaustion forces the process to fail or be killed.
• Does not expose stored data or allow modification of persisted records; confidentiality and data integrity are unaffected.