Hi,

The following vulnerability was published for ujson.

CVE-2026-44660[0]:
| UltraJSON is a fast JSON encoder and decoder written in pure C with
| bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes
| to a file-like object and the write operation raises an exception,
| the serialized JSON string object is not decremented, leaking
| memory. Each failed write operation leaks the full size of the
| serialized payload. This vulnerability is fixed in 5.12.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-44660
https://www.cve.org/CVERecord?id=CVE-2026-44660
[1] https://github.com/ultrajson/ultrajson/security/advisories/GHSA-c38f-wx89-p2xg
[2] https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore