CVE-2026-14803: Mojo::JSON Memory Exhaustion via Unbounded Recursion

Technical summary

The vulnerability exists in Mojo::JSON versions before 9.47 within the pure-Perl JSON decoder's recursive descent implementation. The `_decode_value` function dispatches to `_decode_array` and `_decode_object` handlers that process nested structures with no depth-limiting mechanism. A JSON document with deeply nested arrays or objects causes unbounded stack growth and heap allocation during parsing, leading to memory exhaustion. The vulnerability is specific to the pure-Perl code path, which is the default fallback when the optional Cpanel::JSON::XS extension is unavailable or disabled via the `MOJO_NO_JSON_XS=1` environment variable. Applications using Cpanel::JSON::XS for JSON parsing bypass this code entirely and are not vulnerable.

Business impact

A successful attack denies service to applications by forcing them to crash or hang during JSON parsing. For web services that accept JSON payloads—REST APIs, webhooks, real-time data ingestion—an attacker can send a single malicious JSON request to take down the application or degrade performance for legitimate users. This is particularly damaging in microservice architectures where a single vulnerable Perl service can be targeted to cascade failures. Organizations relying on Mojo framework services for critical workflows should prioritize remediation to prevent availability incidents.

Affected systems

The vulnerability affects Mojo::JSON versions before 9.47. It is triggered only when the pure-Perl decoder is active, which occurs when: (1) Cpanel::JSON::XS is not installed on the system, or (2) the environment variable `MOJO_NO_JSON_XS=1` is explicitly set to disable the fast path. Any Perl application or service using Mojo::JSON from an affected version range—particularly those handling untrusted JSON input from web requests or external APIs—is at risk if these conditions are met. Systems that have Cpanel::JSON::XS installed and enabled are not vulnerable.

Exploitability

Exploitability is straightforward from a network perspective: an attacker simply sends a deeply nested JSON payload to any endpoint that parses JSON bodies. The attack requires no authentication (although the CVSS vector indicates PR:L, meaning the application logic may require a logged-in user), no user interaction, and no special knowledge. Generating a pathological JSON structure is trivial. The primary barrier is determining whether the target application uses the vulnerable pure-Perl path. Attackers would target environments where Cpanel::JSON::XS is known or likely to be absent, such as certain containerized or minimalist deployment configurations. Once a vulnerability is disclosed, automated scanning and exploitation tools will likely emerge.

Remediation

Organizations should upgrade Mojo::JSON to version 9.47 or later as soon as feasible. For environments unable to patch immediately, ensure that Cpanel::JSON::XS is installed and enabled (do not set `MOJO_NO_JSON_XS=1`). This forces use of the hardened C-based decoder, which is not vulnerable. Additionally, implement network-level or application-level limits on JSON payload size and nesting depth as defense-in-depth measures. Monitor for sudden process crashes or memory exhaustion events in Mojo-based services, which may indicate exploitation attempts.

Patch guidance

Update Mojo::JSON to version 9.47 or later. Verify the installed version using `perl -MMojo::JSON -e 'print $Mojo::JSON::VERSION'`. After patching, confirm that the vulnerable pure-Perl code path is no longer triggered for deeply nested structures. Test with a sample JSON document of extreme nesting depth to ensure the fix is in place. If Cpanel::JSON::XS is installed, the patch will switch to the hardened C implementation for JSON parsing. In production environments, deploy patches during a maintenance window and monitor application logs for any parsing-related errors during the transition.

Detection guidance

Monitor application logs and system metrics for signs of exploitation: (1) sudden increases in memory consumption or out-of-memory errors in Mojo services, (2) process crashes or restarts without obvious cause, (3) high CPU usage during JSON parsing, (4) unusual JSON payloads with excessive nesting depth in request logs. Network-level detection is difficult without deep packet inspection, but WAF rules can flag JSON structures exceeding reasonable nesting limits (typically 20–50 levels depending on application). Review application configurations to identify which systems rely on the pure-Perl decoder; prioritize those for patching. Set up alerts on process resource exhaustion for critical Perl services.

Why prioritize this

This vulnerability should be prioritized medium-to-high depending on your environment. The CVSS score is 6.5 (MEDIUM), reflecting availability impact with no authentication bypass or data compromise. However, the ease of exploitation and the widespread use of Mojo in Perl web applications warrant prompt attention. Prioritize services that are internet-facing, handle untrusted input, or are critical to operations. If your deployments use Cpanel::JSON::XS by default, the immediate risk is lower, but you should still patch to avoid configuration drift or accidental disabling of the fast path. The vulnerability is not yet known to be actively exploited in the wild (not on CISA KEV list), giving you a window to deploy fixes before public exploit availability.

Risk score, explained

The CVSS v3.1 score of 6.5 (MEDIUM) reflects a denial-of-service vulnerability with no authentication bypass or data exfiltration. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network attack vector, low attack complexity, and high impact on availability—but requires low privilege (PR:L), suggesting the attacker must be authenticated or the vulnerable code must be reachable via authenticated endpoints. However, depending on your application design, if unauthenticated endpoints accept JSON, the PR:L constraint may not apply in practice. The score appropriately reflects the ease of triggering memory exhaustion against a localized service without broader system compromise.

Frequently asked questions