CVE-2026-44660

Katalog CVE

CVSS 7.5 · High EPSS 0,64%

Kerentanan Missing Release of Memory after Effective Lifetime pada ultrajson project ultrajson. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.

Rincian

Terbit di NVD

27 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg exploit · mitigasi · patch · advisory vendor
• https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9 patch
• https://github.com/ultrajson/ultrajson/releases/tag/5.12.1 product · release notes