{"id":"CVE-2026-68914","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-68914","summary":"Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS…","details":"Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled. An attacker who can supply untrusted JSON to decode_json, from_json, or j can submit deeply nested arrays or objects, causing unbounded recursion, memory exhaustion, and a process crash. Applications using the Cpanel::JSON::XS backend are not affected because that backend already enforces a nesting limit. This issue is fixed in version 9.47.","published":"2026-09-18T16:17:08.897","modified":"2026-09-18T16:17:08.897","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/mojolicious/mojo/commit/cc38b0554275c4d84f6b8b49bcbbc1bec2068fe1","label":"mojolicious/mojo@cc38b05"},"references":[{"type":"WEB","url":"https://github.com/mojolicious/mojo/commit/cc38b0554275c4d84f6b8b49bcbbc1bec2068fe1"},{"type":"WEB","url":"https://github.com/mojolicious/mojo/security/advisories/GHSA-p5qf-qvw8-xgvg"},{"type":"WEB","url":"https://github.com/mojolicious/mojo/security/advisories/GHSA-p5qf-qvw8-xgvg"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T16:17:08.897"}}