Memory Exhaustion in Mojo::JSON Perl Module

Executive Summary

CVE-2026-14803 is a security vulnerability in the pure-Perl implementation of Mojo::JSON for Perl versions before 9.47. The vulnerability arises because the JSON decoder uses unbounded recursion when parsing deeply nested JSON data, which means there is no limit on how deep the recursion can go.

Specifically, the pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses without any depth limit. This allows a small but deeply nested JSON document to consume excessive amounts of memory.

This issue occurs when the Cpanel::JSON::XS module is not installed or when the environment variable MOJO_NO_JSON_XS=1 is set, causing the pure-Perl decoder to be used by default. The fast path using Cpanel::JSON::XS is not affected.

An attacker can exploit this by sending a crafted deeply nested JSON body to an application that decodes untrusted JSON, such as through Mojo::Message::json accessed via $c->req->json, leading to memory exhaustion.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing your application to consume excessive memory when processing deeply nested JSON inputs. This memory exhaustion can lead to denial of service (DoS) conditions, where the application becomes unresponsive or crashes.

If your application decodes untrusted JSON data using the pure-Perl Mojo::JSON decoder (for example, when Cpanel::JSON::XS is not installed or disabled), an attacker can exploit this to disrupt service availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for processes that decode JSON data using the pure-Perl Mojo::JSON decoder without the Cpanel::JSON::XS fast path. Specifically, detection involves identifying if the application is processing deeply nested JSON documents that could trigger unbounded recursion and memory exhaustion.

One approach is to check if the environment variable MOJO_NO_JSON_XS is set to 1, which forces the use of the vulnerable pure-Perl decoder.

Additionally, you can monitor application logs or runtime behavior for signs of excessive memory usage or crashes during JSON decoding.

While no specific commands are provided in the resources, you can use system monitoring tools such as 'top', 'htop', or 'ps' to observe memory consumption of processes running Mojo::JSON decoding.

To check if the vulnerable version of Mojo::JSON is installed, you can run a Perl command to print the version, for example:

• perl -MMojo::JSON -e 'print $Mojo::JSON::VERSION . "\n"'

If the version is before 9.47, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Mojo::JSON to version 9.47 or later, which implements a maximum JSON nesting level of 512 to prevent memory exhaustion.

If upgrading is not immediately possible, ensure that the Cpanel::JSON::XS module is installed and used, as it is not affected by this vulnerability.

Avoid setting the environment variable MOJO_NO_JSON_XS=1, which forces the use of the vulnerable pure-Perl decoder.

Additionally, validate and limit the depth of JSON input from untrusted sources before decoding to prevent deeply nested JSON from being processed.

Useful 0 Not Useful 0