{"schema_version":"1.7.2","id":"OESA-2026-3159","modified":"2026-07-24T03:30:30Z","published":"2026-07-24T03:30:30Z","upstream":["CVE-2026-14803"],"summary":"perl-Mojolicious security update","details":"Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology.\r\n\r\nSecurity Fix(es):\n\nMojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.\n\nThe pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.\n\nThis path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected.\n\nAny caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.(CVE-2026-14803)","affected":[{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"perl-Mojolicious","purl":"pkg:rpm/openEuler/perl-Mojolicious&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-2.oe2203sp4"}]}],"ecosystem_specific":{"noarch":["perl-Mojolicious-9.26-2.oe2203sp4.noarch.rpm","perl-Mojolicious-help-9.26-2.oe2203sp4.noarch.rpm","perl-Test-Mojo-9.26-2.oe2203sp4.noarch.rpm"],"src":["perl-Mojolicious-9.26-2.oe2203sp4.src.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"perl-Mojolicious","purl":"pkg:rpm/openEuler/perl-Mojolicious&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.33-2.oe2403sp1"}]}],"ecosystem_specific":{"noarch":["perl-Mojolicious-9.33-2.oe2403sp1.noarch.rpm","perl-Mojolicious-help-9.33-2.oe2403sp1.noarch.rpm","perl-Test-Mojo-9.33-2.oe2403sp1.noarch.rpm"],"src":["perl-Mojolicious-9.33-2.oe2403sp1.src.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP3","name":"perl-Mojolicious","purl":"pkg:rpm/openEuler/perl-Mojolicious&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.33-2.oe2403sp3"}]}],"ecosystem_specific":{"noarch":["perl-Mojolicious-9.33-2.oe2403sp3.noarch.rpm","perl-Mojolicious-help-9.33-2.oe2403sp3.noarch.rpm","perl-Test-Mojo-9.33-2.oe2403sp3.noarch.rpm"],"src":["perl-Mojolicious-9.33-2.oe2403sp3.src.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP4","name":"perl-Mojolicious","purl":"pkg:rpm/openEuler/perl-Mojolicious&distro=openEuler-24.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.33-2.oe2403sp4"}]}],"ecosystem_specific":{"noarch":["perl-Mojolicious-9.33-2.oe2403sp4.noarch.rpm","perl-Mojolicious-help-9.33-2.oe2403sp4.noarch.rpm","perl-Test-Mojo-9.33-2.oe2403sp4.noarch.rpm"],"src":["perl-Mojolicious-9.33-2.oe2403sp4.src.rpm"]}},{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"perl-Mojolicious","purl":"pkg:rpm/openEuler/perl-Mojolicious&distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-2.oe2003sp4"}]}],"ecosystem_specific":{"noarch":["perl-Mojolicious-9.26-2.oe2003sp4.noarch.rpm","perl-Mojolicious-help-9.26-2.oe2003sp4.noarch.rpm","perl-Test-Mojo-9.26-2.oe2003sp4.noarch.rpm"],"src":["perl-Mojolicious-9.26-2.oe2003sp4.src.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3159"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14803"}],"database_specific":{"severity":"Medium"}}