Read the docs
TI-2026-12479 Aliases CVE-2026-14803GHSA-fp7f-j7qv-4qww

Uncontrolled recursion in SRI Mojo::JSON

Priority LOW 29CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-674.

Summary

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected. Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0053 45th percentileScored 2026-11-07
Fix Fixed Mojo::JSON (SRI): 9.47

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SRIMojo::JSONbefore 9.479.47Patch availableCNA
  • Mojo::JSON VendorSRI Affected before 9.47 Fixed in 9.47 Patch available CNA

Remediation

  • Fix · CNA Mojo::JSON (SRI) Fixed in 9.47

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14803
  2. 2026-10-03 Alias added: GHSA-fp7f-j7qv-4qww
  3. 2026-10-26 Affected versions changed · Red Hat
  4. 2026-10-26 CVSS score added · Red Hat

References

  • TI-2026-13247 Cross-site request forgery in SRI Mojolicious CVSS 3.1CRITICAL 9.1

Sources