CVE-2026-14803

Name of the Vulnerable Software and Affected Versions Mojo::JSON versions prior to 9.47

Description The pure-Perl decoder allows memory exhaustion due to unbounded recursion. Specifically, the decode path where decode value() dispatches to decode array() and decode object() lacks a depth limit, enabling a small but deeply nested JSON document to consume excessive memory. This issue occurs when Cpanel::JSON::XS is not installed or the MOJO NO JSON XS=1 variable is set. Callers decoding untrusted JSON bodies, such as those using Mojo::Message::json via $c->req->json, may experience process memory exhaustion leading to a denial of service.

Recommendations Update to version 9.47 or later. As a temporary mitigation, ensure Cpanel::JSON::XS is installed and the MOJO NO JSON XS variable is not set to 1 to avoid the pure-Perl decode path.