A memory leak vulnerability in the UltraJSON library allows unauthenticated attackers to cause a denial of service through resource exhaustion.

This vulnerability is a memory leak (CWE-401) triggered during the processing of large integers in JSON payloads. Any service utilizing ujson.load, ujson.loads, or ujson.decode on untrusted input is susceptible to exploitation by unauthenticated remote attackers.

The flaw carries a CVSS score of 7.5, classifying it as a High severity issue. Because the vulnerability allows an attacker to repeatedly leak memory until system resources are exhausted, it poses a significant risk of service instability and downtime. This could result in critical business disruption for applications that rely on UltraJSON for high-volume data ingestion.

Immediate Action: Update the UltraJSON (ujson) package to version 5.12.0 or later to incorporate the memory leak fix.

Proactive Monitoring: Monitor system memory usage and server logs for spikes in resource consumption or unexpected application restarts that could indicate a memory exhaustion attempt.

Compensating Controls: Implement strict input validation or size limits on incoming JSON payloads to prevent processing excessively large or malformed integer values.

Public Exploit Available: Unknown

Given the ease of triggering this memory leak and the potential for service denial, organizations should prioritize updating the UltraJSON library to version 5.12.0. Patching is the only effective way to resolve the underlying memory management defect in the C-based parsing logic. Failure to update leaves applications vulnerable to simple, automated denial of service attacks.