CVE-2026-68914: Mojolicious pure-Perl Mojo::JSON decoder allows memory exhaustion via deeply nested data
Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nested arrays or objects, causing unbounded recursion, memory exhaustion, and a process crash. Applications using the Cpanel::JSON::XS backend are not affected because that backend already enforces a nesting limit. This issue is fixed in version 9.47.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mojolicious (Mojo::JSON pure-Perl)to a version that resolves this vulnerability.Fixed in 9.47
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the pure-Perl Mojo::JSON decoder are exposed when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled. Applications using the Cpanel::JSON::XS backend are not affected because it already enforces a nesting limit.
What access does an attacker need?
An attacker must be able to provide untrusted JSON that reaches decode_json, from_json, or j. They can use deeply nested arrays or objects to trigger unbounded recursion, memory exhaustion, and a process crash.
What should be done to remediate the issue?
Upgrade Mojolicious to version 9.47, which fixes the issue. If upgrading is not immediately possible, avoid decoding untrusted JSON through the affected pure-Perl implementation and use the Cpanel::JSON::XS backend where available.