UltraJSON encodes JSON strings in C and, before version 5.12.1, treats a write failure during ujson.dump() as a non‑cleanup path. The serialization buffer is not released when the underlying file write raises an exception, causing a memory leak that equals the full payload size for each failed write. This flaw can exhaust available memory, leading to denial of service for the process and potentially for the host if the process is privileged. The weakness is a classic resource management error (CWE‑401) and also reflects improper release of resources (CWE‑772).

The vulnerable library is ultrajson:ultrajson, affecting all installations of UltraJSON prior to version 5.12.1 for Python 3.7 and later. The fix is included in release 5.12.1.

The CVSS score of 8.7 marks the vulnerability as high severity. Based on the description, it is inferred that an attacker who can control the file‑like destination or trigger a write error—such as by providing a disk‑full or unwritable file or manipulating I/O in a long‑running process—can most readily exploit the flaw. The EPSS score of 0.00052 indicates a very low probability of exploitation, and the issue is not listed in CISA KEV, suggesting that a known exploit is not publicly reported. Based on the description, it is inferred that the attack vector is local, requiring control over the process or environment that triggers a write error, and that local code execution or privilege escalation that enables usage of ujson.dump() would compound the risk.