CVE-2026-68914: Mojolicious pure-Perl Mojo::JSON decoder allows memory exhaustion via deeply nested data
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mojolicious / Mojo::JSONto a version that resolves this vulnerability.Fixed in 9.47
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the pure-Perl Mojo::JSON decoder are exposed when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled. Applications using the Cpanel::JSON::XS backend are not affected because it already enforces a nesting limit.
What access does an attacker need?
An attacker must be able to provide untrusted JSON that reaches decode_json, from_json, or j. They can use deeply nested arrays or objects to trigger unbounded recursion, memory exhaustion, and a process crash.
What should be done to remediate the issue?
Upgrade Mojolicious to version 9.47, which fixes the issue. If upgrading is not immediately possible, avoid decoding untrusted JSON through the affected pure-Perl implementation and use the Cpanel::JSON::XS backend where available.