CVE-2026-14803: CWE-674 Uncontrolled Recursion in SRI Mojo::JSON
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected. Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.
AI Analysis
Technical Summary
CVE-2026-14803 describes an uncontrolled recursion vulnerability (CWE-674) in Mojo::JSON versions prior to 9.47. The pure-Perl JSON decoder functions (_decode_value, _decode_array, _decode_object) recurse without a depth limit, enabling a crafted deeply nested JSON input to exhaust process memory. This vulnerability affects the pure-Perl decode path, which is used by default when Cpanel::JSON::XS is not installed or explicitly disabled via the environment variable MOJO_NO_JSON_XS=1. The Cpanel::JSON::XS fast path is not vulnerable. Exploitation can lead to denial of service by exhausting memory resources during JSON decoding.
Potential Impact
An attacker can cause a denial of service by sending a specially crafted deeply nested JSON document to an application using the vulnerable pure-Perl decoder in Mojo::JSON. This results in unbounded recursion and memory exhaustion, potentially crashing or severely degrading the affected process. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
No official patch or fix is currently confirmed for this vulnerability. Users should verify if they have Cpanel::JSON::XS installed and enabled, as the fast path is not affected. If possible, avoid disabling Cpanel::JSON::XS (i.e., do not set MOJO_NO_JSON_XS=1). Monitor vendor advisories for updates or patches addressing this issue. Until a fix is available, carefully validate or limit the depth of JSON inputs to mitigate memory exhaustion risks.
CVE-2026-14803: CWE-674 Uncontrolled Recursion in SRI Mojo::JSON
Description
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected. Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14803 describes an uncontrolled recursion vulnerability (CWE-674) in Mojo::JSON versions prior to 9.47. The pure-Perl JSON decoder functions (_decode_value, _decode_array, _decode_object) recurse without a depth limit, enabling a crafted deeply nested JSON input to exhaust process memory. This vulnerability affects the pure-Perl decode path, which is used by default when Cpanel::JSON::XS is not installed or explicitly disabled via the environment variable MOJO_NO_JSON_XS=1. The Cpanel::JSON::XS fast path is not vulnerable. Exploitation can lead to denial of service by exhausting memory resources during JSON decoding.
Potential Impact
An attacker can cause a denial of service by sending a specially crafted deeply nested JSON document to an application using the vulnerable pure-Perl decoder in Mojo::JSON. This results in unbounded recursion and memory exhaustion, potentially crashing or severely degrading the affected process. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
No official patch or fix is currently confirmed for this vulnerability. Users should verify if they have Cpanel::JSON::XS installed and enabled, as the fast path is not affected. If possible, avoid disabling Cpanel::JSON::XS (i.e., do not set MOJO_NO_JSON_XS=1). Monitor vendor advisories for updates or patches addressing this issue. Until a fix is available, carefully validate or limit the depth of JSON inputs to mitigate memory exhaustion risks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-07-05T21:23:29.979Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4b0a3227e9c7971969ea54
Added to database: 07/06/2026, 01:51:46 UTC
Last enriched: 07/13/2026, 08:54:02 UTC
Last updated: 08/19/2026, 13:03:07 UTC
Views: 242
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.