A high-severity vulnerability in the Mojolicious web framework allows unauthenticated remote attackers to trigger a denial-of-service condition through memory exhaustion.

This is an uncontrolled resource consumption and recursion vulnerability affecting the Mojo::JSON module. When Cpanel::JSON::XS is absent, an unauthenticated attacker can supply malicious, deeply nested JSON objects to specific decoding functions, resulting in unbounded recursion and subsequent process termination.

The exploitation of this vulnerability results in a denial-of-service, which can render web applications built on the Mojolicious framework inaccessible to legitimate users. With a CVSS score of 8.7, this flaw poses a significant risk to availability, potentially disrupting critical business operations and requiring manual service intervention to restore functionality.

Immediate Action: Update the Mojolicious framework to version 9.47 or later to implement the required nesting depth limits in the JSON parser.

Proactive Monitoring: Monitor application server logs for frequent process crashes or high memory utilization patterns that may indicate targeted exploitation attempts.

Compensating Controls: If an immediate update is not feasible, ensure the Cpanel::JSON::XS backend is installed and enabled, as it is not susceptible to this specific recursion flaw.

Public Exploit Available: No

Given the ease of exploitation and the potential for service disruption, administrators should prioritize updating to version 9.47. Organizations that rely on the pure-Perl JSON implementation should treat this as a critical maintenance task to prevent potential denial-of-service attacks against their web infrastructure.