Mojo::JSON versions prior to 9.47 for Perl contain an unbounded recursion in the pure‑Perl JSON decoder, causing memory exhaustion when a deeply nested JSON document is parsed. The recursion depth is unchecked, so an attacker can send a crafted JSON payload that consumes increasing amounts of interpreter memory, potentially resulting in process termination or a denial of service. The vulnerability is identified as CWE‑674 and affects only the pure‑Perl decoder, which is used by default unless Cpanel::JSON::XS is installed or the MOJO_NO_JSON_XS environment variable is set.

The library SRI:Mojo::JSON, part of the Mojolicious framework, is affected. All releases before version 9.47 are impacted. Applications that invoke Mojo::Message::json or $c->req->json rely on the default pure‑Perl decoder unless Cpanel::JSON::XS is installed or the environment variable MOJO_NO_JSON_XS is not set to 1. These applications, such as web services handling untrusted JSON bodies, are at risk when the fast JSON XS path is not active.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% suggests a low probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the denial of service by sending a maliciously nested JSON payload in an HTTP request that the application processes through Mojo::JSON. Because the pure‑ is used by default, no additional conditions beyond receiving such a payload are required for exploitation.