UltraJSON encodes JSON strings in C and, before version 5.12.1, treats a write failure during ujson.dump() as a non‑cleanup path. The serialization buffer is not released when the underlying file write raises an exception, causing a memory leak that equals the full payload size for each failed write. This flaw can exhaust available memory, leading to denial of service for the process, and potentially for the host if the process is privileged. The weakness is a classic resource management error (CWE‑401).

The vulnerable library is ultrajson:ultrajson, affecting all installations of UltraJSON prior to version 5.12.1 for Python 3.7 and later. The fix is included in release 5.12.1.

The CVSS score of 8.7 marks the vulnerability as high severity. Because the flaw is triggered by a write exception, it is most readily exploitable by an attacker who can control the file‑like destination or induce a write error, such as providing a disk‑full or unwritable file or by manipulating I/O in a long‑running process. The EPSS score is not available, and the issue is not listed in CISA KEV, suggesting that a known exploit is not publicly reported. However, the impact of memory exhaustion could affect availability, and the local nature of the attack vector means that local code execution or privilege escalation that enables usage of ujson.dump() would compound the risk.