CVE-2021-47208
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be...
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- Record
CVE-2021-47208- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2021-33856
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- Record
EUVD-2021-33856- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fv9f-467f-xm3f
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be...
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- Record
GHSA-fv9f-467f-xm3f- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- Record
CVE-2021-47208- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- Record
CVE-2021-47208- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-47208
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- Record
DEBIAN-CVE-2021-47208- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 6 moreShow less
OSVOESA-2024-1517
perl-Mojolicious security update
Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology.
Security Fix(es):
The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.(CVE-2020-36829)
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.(CVE-2021-47208)
- Record
OESA-2024-1517- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-1518
perl-Mojolicious security update
Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology.
Security Fix(es):
The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.(CVE-2020-36829)
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.(CVE-2021-47208)
- Record
OESA-2024-1518- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2024-1519
perl-Mojolicious security update
Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology.
Security Fix(es):
The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.(CVE-2020-36829)
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.(CVE-2021-47208)
- Record
OESA-2024-1519- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-47208
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- Record
UBUNTU-CVE-2021-47208- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-43576 No score
CVE-2021-47208 affecting package perl-Mojolicious 8.57-3
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- Record
AZL-43576- Updated
- 2026-11-02
OSVAZL-45273 No score
CVE-2021-47208 affecting package perl-Mojolicious 8.57-3
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- Record
AZL-45273- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-MojoliciousAzure Linux:2 |
through 8.57-3 | None known |
perl-MojoliciousAzure Linux:3 |
through 8.57-3 | None known |
libmojolicious-perlDebian:12 |
before 9.21+dfsg-1 | 9.21+dfsg-1 |
libmojolicious-perlDebian:13 |
before 9.21+dfsg-1 | 9.21+dfsg-1 |
libmojolicious-perlDebian:14 |
before 9.21+dfsg-1 | 9.21+dfsg-1 |
perl-MojoliciousopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 9.26-1.oe1 | 9.26-1.oe1 |
perl-MojoliciousopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 9.26-1.oe2003sp4 | 9.26-1.oe2003sp4 |
perl-MojoliciousopenEuler:22.03-LTS From an advisory covering 2 CVEs |
before 9.26-1.oe2203 | 9.26-1.oe2203 |
libmojolicious-perlUbuntu:16.04:LTS |
All versions, plus listed versions 6.15+dfsg-16.15+dfsg-1ubuntu1 |
None known |
libmojolicious-perlUbuntu:18.04:LTS |
All versions, plus listed versions 7.39+dfsg-1ubuntu17.43+dfsg-1ubuntu17.57+dfsg-1ubuntu17.59+dfsg-1ubuntu1 |
None known |
libmojolicious-perlUbuntu:20.04:LTS |
All versions, plus listed versions 8.22+dfsg-18.23+dfsg-18.26+dfsg-18.27+dfsg-18.32+dfsg-18.33+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-47208 is a medium vulnerability (CVSS 4.3) in Mojolicious, published April 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in libmojolicious-perl 9.21+dfsg-1.
References
github.com/mojolicious/mojo/issues/1736
nvd.nist.gov/vuln/detail/CVE-2021-47208
security-tracker.debian.org/tracker/CVE-2021-47208
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1517