CVE-2026-14803 Affecting libmojolicious-perl package, versions <9.47+dfsg-1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIANUNSTABLE-LIBMOJOLICIOUSPERL-17821207
- published6 Jul 2026
- disclosed6 Jul 2026
Introduced: 6 Jul 2026
CVE-2026-14803 (opens in a new tab)How to fix?
Upgrade Debian:unstable libmojolicious-perl to version 9.47+dfsg-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libmojolicious-perl package and not the libmojolicious-perl package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.
The pure-Perl decode path (_decode_value dispatching to _decode_array and _decode_object) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.
This path is the default when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS=1 is set; the Cpanel::JSON::XS fast path is not affected.
Any caller that decodes an untrusted JSON body, for example Mojo::Message::json reached through $c->req->json, can exhaust process memory and cause denial of service.