Amazon Linux 2023 Security Advisory: ALAS2023-2026-3209
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-10-12
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.
The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.
This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected.
Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service. (CVE-2026-14803)
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.
_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.
An attacker able to query it can recover the token and pass csrf_protect validation. (CVE-2026-15747)
Affected Packages:
perl-Mojolicious
Issue Correction:
Run dnf update perl-Mojolicious --releasever 2023.12.20261012 or dnf update --advisory ALAS2023-2026-3209 --releasever 2023.12.20261012 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
noarch:
perl-Test-Mojo-9.48-2.amzn2023.0.1.noarch
perl-Mojolicious-9.48-2.amzn2023.0.1.noarch
src:
perl-Mojolicious-9.48-2.amzn2023.0.1.src