CVE-2026-44660High· 7.5▾ TwilightA flaw was found in UltraJSON, a fast JSON encoder and decoder. When the `ujson.dump()` function attempts to write data to a file-like object and an error occurs during this operation, the memory allocated for the serialized JSON string is…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
0.4% → 0.6%
Last analysed / modified upstream
A flaw was found in UltraJSON, a fast JSON encoder and decoder. When the ujson.dump() function attempts to write data to a file-like object and an error occurs during this operation, the memory allocated for the serialized JSON string is not properly released. This continuous failure to deallocate memory can lead to a memory leak, potentially causing resource exhaustion and a Denial of Service (DoS) for the affected system.
python-ujson: UltraJSON: Memory leak leading to Denial of Service — rated Moderate by Red Hat. Released 2026-05-27, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
For Red Hat OpenShift AI 2.25.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:42644 For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734 For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:60520
Workarounds / mitigations:
Affected packages:
ujson < 5.12.1Patched in:
ujson 5.12.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-5241High· 7.7python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting (CVE-2026-5241)
CVE-2026-59884Medium· 5.9python-pyasn1: pyasn1: Denial of Service via crafted BER input (CVE-2026-59884)
CVE-2026-59885High· 7.5pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885)
CVE-2026-44843High· 8.2langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization (CVE-2026-44843)
CVE-2026-34993High· 7.2aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993)
CVE-2026-54283High· 7.5starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS (CVE-2026-54283)