Every CVE Search/ Get API key

CVE-2026-15747

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

9.1 CriticalFix available

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden csrf_token input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrf_protect validation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.25%Up 0.1 points since Jul 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden csrf_token input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrf_protect validation.

Record
CVE-2026-15747
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-204, CWE-352
Updated
2026-11-02
EUVDEUVD-2026-44067 9.1

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden csrf_token input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrf_protect validation.

Record
EUVD-2026-44067
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-6cg9-7rr8-cvj2 9.1

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session...

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden csrf_token input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrf_protect validation.

Record
GHSA-6cg9-7rr8-cvj2
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-204
Updated
2026-11-02
NVD 9.1

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden csrf_token input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrf_protect validation.

Record
CVE-2026-15747
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-204, CWE-352
Updated
2026-11-02
OSV 9.1

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden csrf_token input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrf_protect validation.

Record
CVE-2026-15747
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-204, CWE-352
Updated
2026-11-02
OSVDEBIAN-CVE-2026-15747 9.1

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden csrf_token input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation.

Record
DEBIAN-CVE-2026-15747
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2026-15747 9.1

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden csrf_token input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation.

Record
UBUNTU-CVE-2026-15747
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVAZL-92394 No score

CVE-2026-15747 affecting package perl-Mojolicious 8.57-3

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden csrf_token input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrf_protect validation.

Record
AZL-92394
Updated
2026-11-05
OSVMGASA-2026-0356 No score

Updated perl-Mojolicious packages fix a security vulnerability

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

Record
MGASA-2026-0356
Updated
2026-11-02
OSVopenSUSE-SU-2026:11282-1 No score

perl-Mojolicious-9.480.0-1.1 on GA media

These are all security issues fixed in the perl-Mojolicious-9.480.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11282-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21451-1 No score

Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issues:

Changes in perl-Mojolicious:

  • updated to 9.480.0 (9.48)

    • Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh random value on every request, instead of being reused for the whole lifetime of a session. CVE-2026-15747 bsc#1271431

  • updated to 9.470.0 (9.47)

    • Added support for the QUERY HTTP request method from RFC 10008.
    • Added query and query_p methods to Mojo::UserAgent.
    • Added query method to Mojolicious::Routes::Route.
    • Added query method to Mojolicious::Lite.
    • Added query_ok method to Test::Mojo.
    • Fixed a security issue where the pure-Perl implementation of Mojo::JSON could exhaust all available memory when decoding deeply nested data. Decoding is now limited to 512 levels of nesting, to match the default of Cpanel::JSON::XS.
    • Fixed a memory leak in Morbo. (heikojansen)
    • Fixed Mojo::File::list_tree to no longer follow symbolic links to directories.

  • updated to 9.460.0 (9.46)

    • Added random_bytes function to Mojo::Util. (leont)
    • Improved randomness for CSRF token generation. (leont)
    • Fixed tls_options handling in Mojo::IOLoop::TLS. (krauro)
    • Fixed spec compliance issue with attribute selectors in Mojo::DOM::CSS.

  • updated to 9.450.0 (9.45)

    • Fixed portability issue in WebSocket tests.
    • Fixed various spec compliance issues in Mojo::DOM.
    • Fixed permessage-deflate support in Mojo::Transaction::WebSocket to be more interoperable with non-spec compliant implementations.
    • Fixed punycode roundtrip bug in Mojo::Util.
    • Fixed Windows compatibility issues of Mojo::File::list_tree.

  • updated to 9.420.0 (9.42)

    • Un-deprecated the spurt method in Mojo::File, it is now an alternative to spew.
    • Removed experimental status from top-level await support in Mojo::Promise.
    • Removed experimental status from encrypted session cookie support.
    • Removed experimental status from persistent cookie support.
    • Removed experimental status from samesite cookie support.
    • Removed experimental status from colourful log messages.
    • Removed experimental status from freeze option in Mojo::IOLoop.
    • Removed experimental status from check and raise functions in Mojo::Exception.
    • Fixed Cpanel::JSON::XS compatibility issues. (ilmari)
    • Fixed async/await memory leak in Mojo::Promise. (TFBW)
Record
openSUSE-SU-2026:21451-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21496-1 No score

Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issues:

Changes in perl-Mojolicious:

  • updated to 9.480.0 (9.48)

    • Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh random value on every request, instead of being reused for the whole lifetime of a session. CVE-2026-15747 bsc#1271431

  • updated to 9.470.0 (9.47)

    • Added support for the QUERY HTTP request method from RFC 10008.
    • Added query and query_p methods to Mojo::UserAgent.
    • Added query method to Mojolicious::Routes::Route.
    • Added query method to Mojolicious::Lite.
    • Added query_ok method to Test::Mojo.
    • Fixed a security issue where the pure-Perl implementation of Mojo::JSON could exhaust all available memory when decoding deeply nested data. Decoding is now limited to 512 levels of nesting, to match the default of Cpanel::JSON::XS.
    • Fixed a memory leak in Morbo. (heikojansen)
    • Fixed Mojo::File::list_tree to no longer follow symbolic links to directories.

  • updated to 9.460.0 (9.46)

    • Added random_bytes function to Mojo::Util. (leont)
    • Improved randomness for CSRF token generation. (leont)
    • Fixed tls_options handling in Mojo::IOLoop::TLS. (krauro)
    • Fixed spec compliance issue with attribute selectors in Mojo::DOM::CSS.

  • updated to 9.450.0 (9.45)

    • Fixed portability issue in WebSocket tests.
    • Fixed various spec compliance issues in Mojo::DOM.
    • Fixed permessage-deflate support in Mojo::Transaction::WebSocket to be more interoperable with non-spec compliant implementations.
    • Fixed punycode roundtrip bug in Mojo::Util.
    • Fixed Windows compatibility issues of Mojo::File::list_tree.

  • updated to 9.420.0 (9.42)

    • Un-deprecated the spurt method in Mojo::File, it is now an alternative to spew.
    • Removed experimental status from top-level await support in Mojo::Promise.
    • Removed experimental status from encrypted session cookie support.
    • Removed experimental status from persistent cookie support.
    • Removed experimental status from samesite cookie support.
    • Removed experimental status from colourful log messages.
    • Removed experimental status from freeze option in Mojo::IOLoop.
    • Removed experimental status from check and raise functions in Mojo::Exception.
    • Fixed Cpanel::JSON::XS compatibility issues. (ilmari)
    • Fixed async/await memory leak in Mojo::Promise. (TFBW)
Record
openSUSE-SU-2026:21496-1
Updated
2026-11-02
OSVSUSE-SU-2026:4151-1 No score

Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issue:

  • CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH compression oracle (bsc#1271431).
Record
SUSE-SU-2026:4151-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
perl-Mojolicious
Azure Linux:3
 through 8.57-3 None known
libmojolicious-perl
Debian:12
 All versions, plus listed versions
9.31+dfsg-19.33+dfsg-19.34+dfsg-19.35+dfsg-19.36+dfsg-1
Show 14 moreShow less
9.36+dfsg-1~bpo12+29.37+dfsg-19.37+dfsg-29.37+dfsg-2~bpo12+19.38+dfsg-19.39+dfsg-19.42+dfsg-19.42+dfsg-1~bpo13+29.45+dfsg-19.45+dfsg-29.46+dfsg-19.47+dfsg-19.48+dfsg-19.49+dfsg-1
 None known
libmojolicious-perl
Debian:13
 All versions, plus listed versions
9.39+dfsg-19.42+dfsg-19.42+dfsg-1~bpo13+29.45+dfsg-19.45+dfsg-2
Show 4 moreShow less
9.46+dfsg-19.47+dfsg-19.48+dfsg-19.49+dfsg-1
 None known
libmojolicious-perl
Debian:14
 before 9.48+dfsg-1, plus listed versions
9.39+dfsg-19.42+dfsg-19.42+dfsg-1~bpo13+29.45+dfsg-19.45+dfsg-29.46+dfsg-19.47+dfsg-1
9.48+dfsg-1
perl-Mojolicious
Mageia:10
 before 9.480.0-1.1.mga10
9.480.0-1.1.mga10
perl-Mojolicious
Mageia:9
 before 9.480.0-1.1.mga9
9.480.0-1.1.mga9
perl-Mojolicious
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 9.370.0-150700.3.3.1
9.370.0-150700.3.3.1
libmojolicious-perl
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.15+dfsg-16.15+dfsg-1ubuntu1
 None known
libmojolicious-perl
Ubuntu:18.04:LTS
 All versions, plus listed versions
7.39+dfsg-1ubuntu17.43+dfsg-1ubuntu17.57+dfsg-1ubuntu17.59+dfsg-1ubuntu1
 None known
libmojolicious-perl
Ubuntu:20.04:LTS
 All versions, plus listed versions
8.22+dfsg-18.23+dfsg-18.26+dfsg-18.27+dfsg-18.32+dfsg-18.33+dfsg-1
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
libmojolicious-perl
Ubuntu:22.04:LTS
 All versions, plus listed versions
8.71+dfsg-19.22+dfsg-1
 None known
libmojolicious-perl
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.33+dfsg-19.35+dfsg-1
 None known
libmojolicious-perl
Ubuntu:26.10
 All versions, plus listed versions
9.42+dfsg-19.45+dfsg-29.46+dfsg-19.48+dfsg-1
 None known
libmojolicious-perl
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.39+dfsg-19.42+dfsg-1
 None known
perl-Mojolicious
openSUSE:Tumbleweed
 before 9.480.0-1.1
9.480.0-1.1
perl-Mojolicious
openSUSE:Leap 16.0
 before 9.480.0-bp160.1.1
9.480.0-bp160.1.1

History

History
RecordedChangedSources
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-15747 is a critical vulnerability (CVSS 9.1) in Sri Mojolicious, published July 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in libmojolicious-perl 9.48+dfsg-1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open