CVE-2026-68914

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-68914
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate.
CVSS

No CVSS.

References

No reference.

Configurations

No configuration.

History

21 Sep 2026, 18:17

Type Values Removed Values Added
References
  • {'url': 'https://github.com/mojolicious/mojo/commit/cc38b0554275c4d84f6b8b49bcbbc1bec2068fe1', 'source': 'security-advisories@github.com'}
  • {'url': 'https://github.com/mojolicious/mojo/security/advisories/GHSA-p5qf-qvw8-xgvg', 'source': 'security-advisories@github.com'}
CWE CWE-674
CWE-400
Summary (en) Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled. An attacker who can supply untrusted JSON to decode_json, from_json, or j can submit deeply nested arrays or objects, causing unbounded recursion, memory exhaustion, and a process crash. Applications using the Cpanel::JSON::XS backend are not affected because that backend already enforces a nesting limit. This issue is fixed in version 9.47. (en) Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate.

18 Sep 2026, 16:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-18 16:17

Updated : 2026-09-21 18:17

NVD link : CVE-2026-68914

Mitre link : CVE-2026-68914

CVE.ORG link : CVE-2026-68914

JSON object : View

Products Affected

No product.

CWE

No CWE.