EUVD-2026-41798
GHSA-fp7f-j7qv-4qww
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The decoder imposes no authentication gate; any reachable JSON endpoint is exposed, so PR:N is more accurate than PR:L.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.
The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.
This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected.
Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.
AnalysisAI
Memory exhaustion via uncontrolled recursion in Mojo::JSON's pure-Perl decoder allows network-accessible callers to cause denial of service in Mojolicious applications. All versions before 9.47 are affected when the pure-Perl decode path is active - specifically when Cpanel::JSON::XS is absent or MOJO_NO_JSON_XS=1 is set. No public exploit has been identified and EPSS sits at 0.19% (8th percentile), but the attack is conceptually trivial given the published patch diff and OSS-Security advisory.
Technical ContextAI
Mojo::JSON is the JSON component of the Mojolicious web framework for Perl (CPE: cpe:2.3:a:sri:mojo::json). The root cause is CWE-674 (Uncontrolled Recursion): the pure-Perl decoder uses mutual recursion across three functions - _decode_value dispatches to _decode_array or _decode_object depending on the opening token, and both array and object handlers recursively call _decode_value for each element or value. With no maximum depth guard, a crafted payload consisting entirely of nested arrays (e.g., [[[[...]]]]) or nested objects grows the call stack proportionally to nesting depth until process memory is exhausted. The XS-accelerated code path provided by the optional Cpanel::JSON::XS module does not share this Perl-level recursion and is entirely unaffected. The vulnerable path is the runtime default when Cpanel::JSON::XS cannot be loaded.
RemediationAI
Upgrade Mojolicious to version 9.47 or later, which introduces a recursion depth limit in the pure-Perl JSON decoder. The fix commit is available at https://github.com/mojolicious/mojo/commit/cc38b0554275c4d84f6b8b49bcbbc1bec2068fe1.patch and the release changelog is at https://metacpan.org/release/SRI/Mojolicious-9.47/changes. For deployments that cannot upgrade immediately, the most effective compensating control is installing Cpanel::JSON::XS (available from CPAN), which causes Mojo::JSON to use the unaffected XS code path at runtime - verify the module is loadable with perl -MCpanel::JSON::XS -e 1. A secondary workaround is adding a JSON body size limit at the reverse proxy (e.g., client_max_body_size 1m in nginx or LimitRequestBody in Apache) to constrain payload size; note this reduces but does not eliminate risk, because deeply nested payloads can be small in bytes yet deeply recursive. Do not rely on unsetting MOJO_NO_JSON_XS alone unless Cpanel::JSON::XS is confirmed installed.
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today