CyberRota Analysis
AI-GeneratedMojo::JSON versions prior to 9.47 for Perl are vulnerable to memory exhaustion due to unbounded recursion in the pure-Perl JSON decoder, which can be triggered by processing deeply nested JSON documents. This vulnerability can lead to denial of service by consuming excessive memory, particularly affecting applications that decode untrusted JSON input without the Cpanel::JSON::XS module. Developers and system administrators using Mojo::JSON in environments where Cpanel::JSON::XS is not available should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected. Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.