An update for perl-Mojolicious is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3159 Final 1.0 1.0 2026-07-24 Initial 2026-07-24 2026-07-24 openEuler SA Tool V1.0 2026-07-24 perl-Mojolicious security update An update for perl-Mojolicious is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4 Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology. Security Fix(es): Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected. Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.(CVE-2026-14803) An update for perl-Mojolicious is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium perl-Mojolicious https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3159 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-14803 https://nvd.nist.gov/vuln/detail/CVE-2026-14803 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 perl-Mojolicious-9.26-2.oe2203sp4.noarch.rpm perl-Mojolicious-help-9.26-2.oe2203sp4.noarch.rpm perl-Test-Mojo-9.26-2.oe2203sp4.noarch.rpm perl-Mojolicious-9.33-2.oe2403sp1.noarch.rpm perl-Mojolicious-help-9.33-2.oe2403sp1.noarch.rpm perl-Test-Mojo-9.33-2.oe2403sp1.noarch.rpm perl-Mojolicious-9.33-2.oe2403sp3.noarch.rpm perl-Mojolicious-help-9.33-2.oe2403sp3.noarch.rpm perl-Test-Mojo-9.33-2.oe2403sp3.noarch.rpm perl-Mojolicious-9.33-2.oe2403sp4.noarch.rpm perl-Mojolicious-help-9.33-2.oe2403sp4.noarch.rpm perl-Test-Mojo-9.33-2.oe2403sp4.noarch.rpm perl-Mojolicious-9.26-2.oe2003sp4.noarch.rpm perl-Mojolicious-help-9.26-2.oe2003sp4.noarch.rpm perl-Test-Mojo-9.26-2.oe2003sp4.noarch.rpm perl-Mojolicious-9.26-2.oe2203sp4.src.rpm perl-Mojolicious-9.33-2.oe2403sp1.src.rpm perl-Mojolicious-9.33-2.oe2403sp3.src.rpm perl-Mojolicious-9.33-2.oe2403sp4.src.rpm perl-Mojolicious-9.26-2.oe2003sp4.src.rpm Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected. Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service. 2026-07-24 CVE-2026-14803 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H perl-Mojolicious security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3159