{"id":"CVE-2026-68914","aliases":["EUVD-2026-83031","GHSA-p5qf-qvw8-xgvg","UBUNTU-CVE-2026-68914","openSUSE-SU-2026:11850-1","openSUSE-SU-2026:21956-1"],"status":"rejected","title":"Mojolicious pure-Perl Mojo::JSON decoder allows memory exhaustion via deeply nested data","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","from":"euvd"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-674"],"published":"2026-09-18T16:07:27Z","modified":"2026-09-25T18:27:24Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Mojolicious","fixed_in":["9.490.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Mojolicious","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.490.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Mojolicious","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.480.0-bp160.2.1"}]}],"bundled":2}],"references":[{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68914.json","tags":["advisory"]},{"url":"https://github.com/mojolicious/mojo/security/advisories/GHSA-p5qf-qvw8-xgvg","tags":["advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68914","tags":["advisory"]},{"url":"https://github.com/mojolicious/mojo/commit/cc38b0554275c4d84f6b8b49bcbbc1bec2068fe1","tags":["fix","report"]},{"url":"https://ubuntu.com/security/CVE-2026-68914","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68914","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68914","tags":["web"]},{"url":"https://bugzilla.suse.com/1281637","tags":["report"]},{"url":"https://bugzilla.suse.com/1281638","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77568","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-68914","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate.","status":"rejected","published":"2026-09-18T16:07:27.117Z","modified":"2026-09-21T17:52:24.272Z","updated_at":"2026-11-02T13:45:59.110885Z"}],"euvd":[{"id":"EUVD-2026-83031","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate.","status":"published","published":"2026-09-18T16:07:27Z","modified":"2026-09-21T17:52:24Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:05.032636Z"}],"nvd":[{"id":"CVE-2026-68914","description":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate.","status":"rejected","published":"2026-09-18T16:17:08.897Z","modified":"2026-09-21T18:17:10.11Z","updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"CVE-2026-68914","title":"Mojolicious pure-Perl Mojo::JSON decoder allows memory exhaustion via deeply nested data","description":"Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled. An attacker who can supply untrusted JSON to decode_json, from_json, or j can submit deeply nested arrays or objects, causing unbounded recursion, memory exhaustion, and a process crash. Applications using the Cpanel::JSON::XS backend are not affected because that backend already enforces a nesting limit. This issue is fixed in version 9.47.","status":"published","published":"2026-09-18T16:07:27.117Z","modified":"2026-09-25T18:27:24.847423541Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T15:45:14.808935Z"},{"id":"UBUNTU-CVE-2026-68914","description":"Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled. An attacker who can supply untrusted JSON to decode_json, from_json, or j can submit deeply nested arrays or objects, causing unbounded recursion, memory exhaustion, and a process crash. Applications using the Cpanel::JSON::XS backend are not affected because that backend already enforces a nesting limit. This issue is fixed in version 9.47.","status":"withdrawn","published":"2026-09-21T00:00:00Z","modified":"2026-09-24T02:00:51.959541928Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"openSUSE-SU-2026:11850-1","title":"perl-Mojolicious-9.490.0-2.1 on GA media","description":"These are all security issues fixed in the perl-Mojolicious-9.490.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-09-23T09:15:06.255191241Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21956-1","title":"Security update for perl-Mojolicious","description":"This update for perl-Mojolicious fixes the following issues:\n\nChanges in perl-Mojolicious:\n\n- Adding missing CVE references already fixed in the past:\n    CVE-2026-77568 bsc#1281638, CVE-2026-68914 bsc#1281637.\n","status":"published","published":"2026-09-24T14:35:04Z","modified":"2026-09-25T18:23:15.136881189Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}