Vulnerability details

CVE-2026-15747

SRI Mojolicious

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

CVSS 3.1

9.1Critical

Official description

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
SRI	Mojolicious	4.59 ≤ v < 9.48	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-14
Last updated: 2026-07-15
State: Published
Assigner (CNA): CPANSec

Exploit prediction (EPSS)

0.25%

Probability of exploitation in 30 days

16.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-204
Observable Response Discrepancy
CWE-352
Cross-Site Request Forgery (CSRF)