CVE-2026-14803

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder

6.5 MediumFix available

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.

The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.

This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected.

Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.53%Up 0.3 points since Jul 6, 2026

What each source reports

CVE List Score used 6.5

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.

The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.

This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected.

Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.

Record: CVE-2026-14803
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

EUVDEUVD-2026-41798 6.5

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.

The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.

This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected.

Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.

Record: EUVD-2026-41798
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fp7f-j7qv-4qww 6.5

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the...

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.

The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.

This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected.

Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.

Record: GHSA-fp7f-j7qv-4qww
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

NVD 6.5

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.

The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.

This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected.

Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.

Record: CVE-2026-14803
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

OSV 6.5

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.

The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.

This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected.

Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.

Record: CVE-2026-14803
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-14803 6.5

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected. Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.

Record: DEBIAN-CVE-2026-14803
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVOESA-2026-3159 6.5

perl-Mojolicious security update

Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology.

Security Fix(es):

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.

The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.

This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected.

Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.(CVE-2026-14803)

Record: OESA-2026-3159
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-14803 6.5

Record: UBUNTU-CVE-2026-14803
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-92078 No score

CVE-2026-14803 affecting package perl-Mojolicious 8.57-3

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.

The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.

This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected.

Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.

Record: AZL-92078
Updated: 2026-11-05

OSVMGASA-2026-0269 No score

Updated perl-Mojolicious package fixes a security vulnerability

The updated package fixes a security vulnerability: Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. (CVE-2026-14803)

Record: MGASA-2026-0269
Updated: 2026-11-02

Affected products

sri mojo::json

Affected packages

Affected packages
Package	Affected	Fixed
`perl-Mojolicious` Azure Linux:3	through 8.57-3	None known
`libmojolicious-perl` Debian:12	All versions, plus listed versions 9.31+dfsg-19.33+dfsg-19.34+dfsg-19.35+dfsg-19.36+dfsg-1 Show 14 moreShow less 9.36+dfsg-1~bpo12+29.37+dfsg-19.37+dfsg-29.37+dfsg-2~bpo12+19.38+dfsg-19.39+dfsg-19.42+dfsg-19.42+dfsg-1~bpo13+29.45+dfsg-19.45+dfsg-29.46+dfsg-19.47+dfsg-19.48+dfsg-19.49+dfsg-1	None known
`libmojolicious-perl` Debian:13	All versions, plus listed versions 9.39+dfsg-19.42+dfsg-19.42+dfsg-1~bpo13+29.45+dfsg-19.45+dfsg-2 Show 4 moreShow less 9.46+dfsg-19.47+dfsg-19.48+dfsg-19.49+dfsg-1	None known
`libmojolicious-perl` Debian:14	before 9.47+dfsg-1, plus listed versions 9.39+dfsg-19.42+dfsg-19.42+dfsg-1~bpo13+29.45+dfsg-19.45+dfsg-29.46+dfsg-1	9.47+dfsg-1
`perl-Mojolicious` Mageia:10	before 9.420.0-1.1.mga10	9.420.0-1.1.mga10
`perl-Mojolicious` Mageia:9	before 9.310.0-1.1.mga9	9.310.0-1.1.mga9
`perl-Mojolicious` openEuler:22.03-LTS-SP4	before 9.26-2.oe2203sp4	9.26-2.oe2203sp4
`perl-Mojolicious` openEuler:24.03-LTS-SP1	before 9.33-2.oe2403sp1	9.33-2.oe2403sp1
`perl-Mojolicious` openEuler:24.03-LTS-SP3	before 9.33-2.oe2403sp3	9.33-2.oe2403sp3
`perl-Mojolicious` openEuler:24.03-LTS-SP4	before 9.33-2.oe2403sp4	9.33-2.oe2403sp4

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`perl-Mojolicious` openEuler:20.03-LTS-SP4	before 9.26-2.oe2003sp4	9.26-2.oe2003sp4
`libmojolicious-perl` Ubuntu:16.04:LTS	All versions, plus listed versions 6.15+dfsg-16.15+dfsg-1ubuntu1	None known
`libmojolicious-perl` Ubuntu:18.04:LTS	All versions, plus listed versions 7.39+dfsg-1ubuntu17.43+dfsg-1ubuntu17.57+dfsg-1ubuntu17.59+dfsg-1ubuntu1	None known
`libmojolicious-perl` Ubuntu:20.04:LTS	All versions, plus listed versions 8.22+dfsg-18.23+dfsg-18.26+dfsg-18.27+dfsg-18.32+dfsg-18.33+dfsg-1	None known
`libmojolicious-perl` Ubuntu:22.04:LTS	All versions, plus listed versions 8.71+dfsg-19.22+dfsg-1	None known
`libmojolicious-perl` Ubuntu:24.04:LTS	All versions, plus listed versions 9.33+dfsg-19.35+dfsg-1	None known
`libmojolicious-perl` Ubuntu:25.10	All versions, plus listed versions 9.39+dfsg-1	None known
`libmojolicious-perl` Ubuntu:26.10	All versions, plus listed versions 9.42+dfsg-19.45+dfsg-29.46+dfsg-19.48+dfsg-1	None known
`libmojolicious-perl` Ubuntu:26.04:LTS	All versions, plus listed versions 9.39+dfsg-19.42+dfsg-1	None known

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-14803 is a medium vulnerability (CVSS 6.5) in Sri Mojo::json, published July 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in libmojolicious-perl 9.47+dfsg-1.

References

Show 9 moreShow less