CVE-2026-68914

Mojolicious pure-Perl Mojo::JSON decoder allows memory exhaustion via deeply nested data

8.7 HighFix availableRejected

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

What each source reports

EUVD Score usedEUVD-2026-830318.7

Record: EUVD-2026-83031
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2026-68914
Updated: 2026-11-02

NVDNo score

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate.

Record: CVE-2026-68914
Updated: 2026-11-02

OSV8.7

Mojolicious pure-Perl Mojo::JSON decoder allows memory exhaustion via deeply nested data

Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled. An attacker who can supply untrusted JSON to decode_json, from_json, or j can submit deeply nested arrays or objects, causing unbounded recursion, memory exhaustion, and a process crash. Applications using the Cpanel::JSON::XS backend are not affected because that backend already enforces a nesting limit. This issue is fixed in version 9.47.

Record: CVE-2026-68914
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-400, CWE-674
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-689148.7

Record: UBUNTU-CVE-2026-68914
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11850-1No score

perl-Mojolicious-9.490.0-2.1 on GA media

These are all security issues fixed in the perl-Mojolicious-9.490.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11850-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21956-1No score

Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issues:

Changes in perl-Mojolicious:

Adding missing CVE references already fixed in the past: CVE-2026-77568 bsc#1281638, CVE-2026-68914 bsc#1281637.

Record: openSUSE-SU-2026:21956-1
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`perl-Mojolicious` openSUSE:Tumbleweed	before 9.490.0-2.1	9.490.0-2.1
`perl-Mojolicious` openSUSE:Leap 16.0 From an advisory covering 2 CVEs	before 9.480.0-bp160.2.1	9.480.0-bp160.2.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-68914 has been rejected by its source and should not be treated as a live vulnerability, published September 18, 2026. Fixed in perl-Mojolicious 9.490.0-2.1.

References

Show 4 moreShow less