Uncontrolled recursion in SRI Mojo::JSON
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-674.
Summary
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected. Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Mojo::JSON (SRI) Fixed in 9.47
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-14803
- 2026-10-03 Alias added: GHSA-fp7f-j7qv-4qww
- 2026-10-26 Affected versions changed · Red Hat
- 2026-10-26 CVSS score added · Red Hat
References
More SRI vulnerabilities
- TI-2026-13247 Cross-site request forgery in SRI Mojolicious CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-14803 · CVE Program
- CVE-2026-14803 · NVD
- FIRST EPSS
- GHSA-fp7f-j7qv-4qww · GitHub Advisory Database · CC BY 4.0
- CVE-2026-14803 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences