Every CVESearch/Get API key

CVE-2026-77568

Mojolicious: CSRF tokens are vulnerable to BREACH attacks

4.2 MediumRejected

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

What each source reports

EUVD Score usedEUVD-2026-830354.2

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.

Record
EUVD-2026-83035
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
CVE ListNo score

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.

Record
CVE-2026-77568
Updated
2026-11-02
NVDNo score

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.

Record
CVE-2026-77568
Updated
2026-11-02
OSV4.2

Mojolicious: CSRF tokens are vulnerable to BREACH attacks

Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.

Record
CVE-2026-77568
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-200, CWE-352
Updated
2026-11-02
OSVUBUNTU-CVE-2026-775684.2

Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.

Record
UBUNTU-CVE-2026-77568
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:21956-1No score

Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issues:

Changes in perl-Mojolicious:

  • Adding missing CVE references already fixed in the past: CVE-2026-77568 bsc#1281638, CVE-2026-68914 bsc#1281637.
Record
openSUSE-SU-2026:21956-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
perl-Mojolicious
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
before 9.480.0-bp160.2.1
9.480.0-bp160.2.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77568 has been rejected by its source and should not be treated as a live vulnerability, published September 18, 2026.

References

Show 4 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open