CVE-2026-14803: Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.
The pure-Perl decode path (decodevalue dispatching to decodearray and decodeobject) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.
This path is the default when Cpanel::JSON::XS is not installed or MOJONOJSONXS=1 is set; the Cpanel::JSON::XS fast path is not affected.
Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mojo::JSON (Perl)to a version that resolves this vulnerability.Fixed in 9.47Patch CVE-2026-14803 - Configuration
Ensure the pure-Perl JSON decoder is not used by unsetting MOJO_NO_JSON_XS (so the Cpanel::JSON::XS fast path is available), since the pure-Perl decode path has no recursion depth limit.
Mojo::JSON / Mojolicious MOJO_NO_JSON_XS = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14803?
CVE-2026-14803 has a risk score of 30, indicating a moderate severity vulnerability.
How do I fix CVE-2026-14803?
To fix CVE-2026-14803, upgrade your Mojo::JSON to version 9.47 or later.
What are the consequences of CVE-2026-14803?
CVE-2026-14803 can lead to memory exhaustion due to unbounded recursion when processing deeply nested JSON documents.
Which versions of Mojo::JSON are affected by CVE-2026-14803?
Mojolicious Mojo::JSON versions prior to 9.47 are affected by CVE-2026-14803.
Is there a known workaround for CVE-2026-14803?
There is no official workaround for CVE-2026-14803; upgrading to the fixed version is recommended.