CVE-2026-44660 is a memory leak vulnerability in the UltraJSON (ujson) library. Specifically, when the ujson.dump() function attempts to write serialized JSON data to a file-like object and an error occurs during this operation, the allocated memory for the JSON string is not properly released. This continuous failure to free memory can lead to resource exhaustion and denial of service. The flaw affects applications that use ujson.dump() with potentially attacker-controlled input or file-like objects. Other ujson functions such as ujson.dumps() or JSON decoding are not affected. Red Hat has analyzed this vulnerability and currently does not offer a patch or mitigation that meets their deployment and stability standards.

The vulnerability can lead to denial of service due to memory exhaustion on affected systems running applications that use ujson.dump() with file-like objects. This can disrupt normal operations by consuming system memory resources. There is no impact on confidentiality or integrity. The flaw does not affect JSON decoding or other ujson functions. No known exploits are reported in the wild.

Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, and stability. Users should avoid using ujson.dump() with untrusted or attacker-controlled input or file-like objects where possible. Deployments using only ujson.dumps() or JSON decoding functions are not affected. Monitor Red Hat advisories for future updates or patches. Consider alternative JSON serialization libraries if this vulnerability poses a risk to your environment.