CVE-2026-14803— Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected. Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.

N/A

未经控制的递归

SRI Mojolicious 资源管理错误漏洞

SRI Mojolicious是SRI个人开发者的一个Perl Web开发框架，集成路由、模板引擎、WebSocket、REST API和实时Web应用开发能力。 SRI Mojolicious 9.47之前版本存在资源管理错误漏洞，该漏洞源于纯Perl解码器中无界递归，可能导致小深度嵌套JSON文档消耗过多内存，耗尽进程内存并导致拒绝服务。

N/A

N/A