Unbounded Recursion Vulnerability in Mojolicious Framework for Perl

CVE-2026-68914

What is CVE-2026-68914?

The Mojolicious web framework for Perl contains a vulnerability in its pure-Perl implementation of Mojo::JSON prior to version 9.47. When the Cpanel::JSON::XS backend is unavailable or when MOJO_NO_JSON_XS is enabled, an attacker can exploit the lack of nesting depth limitation by supplying deeply nested JSON structures to methods like decode_json, from_json, or j. This can lead to unbounded recursion, resulting in memory exhaustion and potentially crashing the application. Users utilizing the Cpanel::JSON::XS backend are not affected as it implements a nesting limit to prevent such issues. The vulnerability has been addressed in version 9.47.

References