Source: ujson Version: 5.11.0-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for ujson. CVE-2026-44660[0]: | UltraJSON is a fast JSON encoder and decoder written in pure C with | bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes | to a file-like object and the write operation raises an exception, | the serialized JSON string object is not decremented, leaking | memory. Each failed write operation leaks the full size of the | serialized payload. This vulnerability is fixed in 5.12.1. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-44660 https://www.cve.org/CVERecord?id=CVE-2026-44660 [1] https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg [2] https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
