CVE-2026-14803 describes an uncontrolled recursion vulnerability (CWE-674) in Mojo::JSON versions prior to 9.47. The pure-Perl JSON decoder functions (_decode_value, _decode_array, _decode_object) recurse without a depth limit, enabling a small but deeply nested JSON input to consume excessive memory. This vulnerability is triggered when the pure-Perl decoder is used, which is the default if the Cpanel::JSON::XS module is absent or explicitly disabled via the MOJO_NO_JSON_XS environment variable. Attackers can exploit this by sending malicious JSON to any caller decoding untrusted JSON, such as Mojo::Message::json accessed via $c->req->json, causing denial of service through memory exhaustion. The Cpanel::JSON::XS fast path is not vulnerable. No CVSS score or official remediation level is provided, and no known exploits are reported in the wild.

An attacker can cause denial of service by sending a crafted deeply nested JSON document that triggers unbounded recursion in the pure-Perl decoder, leading to excessive memory consumption and process exhaustion. This affects applications using Mojo::JSON versions before 9.47 when the pure-Perl decoder is active (i.e., when Cpanel::JSON::XS is not installed or disabled). The impact is limited to denial of service via memory exhaustion; no code execution or data leakage is described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should ensure that the Cpanel::JSON::XS module is installed and enabled, as the fast path is not affected. Avoid disabling Cpanel::JSON::XS (e.g., do not set MOJO_NO_JSON_XS=1) to prevent fallback to the vulnerable pure-Perl decoder. Additionally, validate or limit the depth of JSON inputs before decoding to reduce risk of memory exhaustion.