Vulnerability Description
Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled. An attacker who can supply untrusted JSON to decode_json, from_json, or j can submit deeply nested arrays or objects, causing unbounded recursion, memory exhaustion, and a process crash. Applications using the Cpanel::JSON::XS backend are not affected because that backend already enforces a nesting limit. This issue is fixed in version 9.47.
Related Weaknesses (CWE)
References
- https://github.com/mojolicious/mojo/commit/cc38b0554275c4d84f6b8b49bcbbc1bec2068
- https://github.com/mojolicious/mojo/security/advisories/GHSA-p5qf-qvw8-xgvg
- https://github.com/mojolicious/mojo/security/advisories/GHSA-p5qf-qvw8-xgvg
FAQ
What is CVE-2026-68914?
CVE-2026-68914 is a documented vulnerability. Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is ena...
How severe is CVE-2026-68914?
CVSS scoring is not yet available for CVE-2026-68914. Check NVD for updates.
Is there a patch for CVE-2026-68914?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.