CVE-2026-14803 | Mojo::JSON versions before 9.47 for Perl allow memory exhaus…

Description

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected. Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.

Metadata

CVE ID: CVE-2026-14803
State: PUBLISHED
Assigner: CPANSec
Reserved: 2026-07-05 21:23 UTC
Published: 2026-07-06 01:34 UTC
Last updated: 2026-07-06 05:27 UTC
Primary CWE: CWE-674
CWE-674 Uncontrolled Recursion
Vendor / Product: SRI / Mojo::JSON
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
SRI	Mojo::JSON	—	0 < 9.47

Weakness (CWE)

CWE	Source	Description
CWE-674	cna	CWE-674 Uncontrolled Recursion

References (2)