{"id":"CVE-2026-15747","aliases":["AZL-92394","DEBIAN-CVE-2026-15747","EUVD-2026-44067","GHSA-6cg9-7rr8-cvj2","MGASA-2026-0356","SUSE-SU-2026:4151-1","UBUNTU-CVE-2026-15747","openSUSE-SU-2026:11282-1","openSUSE-SU-2026:21451-1","openSUSE-SU-2026:21496-1"],"status":"published","title":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle","description":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.\n\n_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.\n\nAn attacker able to query it can recover the token and pass csrf_protect validation.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0025,"percentile":0.1644,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-204","CWE-352"],"published":"2026-07-14T17:07:32Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:14","package":"libmojolicious-perl","fixed_in":["9.48+dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"perl-Mojolicious","fixed_in":["9.480.0-1.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Mojolicious","fixed_in":["9.480.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"perl-Mojolicious","fixed_in":["9.370.0-150700.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Mojolicious","fixed_in":["9.480.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"perl-Mojolicious","fixed_in":["9.480.0-bp160.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Mojolicious","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.57-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libmojolicious-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.31+dfsg-1","9.33+dfsg-1","9.34+dfsg-1","9.35+dfsg-1","9.36+dfsg-1","9.36+dfsg-1~bpo12+2","9.37+dfsg-1","9.37+dfsg-2","9.37+dfsg-2~bpo12+1","9.38+dfsg-1","9.39+dfsg-1","9.42+dfsg-1","9.42+dfsg-1~bpo13+2","9.45+dfsg-1","9.45+dfsg-2","9.46+dfsg-1","9.47+dfsg-1","9.48+dfsg-1","9.49+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libmojolicious-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.39+dfsg-1","9.42+dfsg-1","9.42+dfsg-1~bpo13+2","9.45+dfsg-1","9.45+dfsg-2","9.46+dfsg-1","9.47+dfsg-1","9.48+dfsg-1","9.49+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libmojolicious-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.48+dfsg-1"}]}],"versions":["9.39+dfsg-1","9.42+dfsg-1","9.42+dfsg-1~bpo13+2","9.45+dfsg-1","9.45+dfsg-2","9.46+dfsg-1","9.47+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Mojolicious","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.480.0-1.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Mojolicious","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.480.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"perl-Mojolicious","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.370.0-150700.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libmojolicious-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.15+dfsg-1","6.15+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libmojolicious-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.39+dfsg-1ubuntu1","7.43+dfsg-1ubuntu1","7.57+dfsg-1ubuntu1","7.59+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libmojolicious-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.22+dfsg-1","8.23+dfsg-1","8.26+dfsg-1","8.27+dfsg-1","8.32+dfsg-1","8.33+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmojolicious-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.71+dfsg-1","9.22+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libmojolicious-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.33+dfsg-1","9.35+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libmojolicious-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.42+dfsg-1","9.45+dfsg-2","9.46+dfsg-1","9.48+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libmojolicious-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.39+dfsg-1","9.42+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Mojolicious","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.480.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Mojolicious","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.480.0-bp160.1.1"}]}]}],"products":[{"vendor":"sri","product":"mojolicious"}],"references":[{"url":"https://github.com/mojolicious/mojo/commit/01921fbbbbeca2d1397e082d4a647f9b84c24e27.patch","tags":["patch","fix","report"]},{"url":"https://metacpan.org/release/SRI/Mojolicious-9.48/changes","tags":["release-notes","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/14/16","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15747","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6cg9-7rr8-cvj2"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15747.json","tags":["advisory"]},{"url":"https://github.com/mojolicious/mojo","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-15747","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0356.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35928","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/16","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264151-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271431","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15747","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-15747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15747","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41816171/","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-15747","title":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle","description":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.\n\n_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.\n\nAn attacker able to query it can recover the token and pass csrf_protect validation.","status":"published","published":"2026-07-14T17:07:32.593Z","modified":"2026-07-15T16:32:58.629Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-204","CWE-352"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-44067","description":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.\n\n_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.\n\nAn attacker able to query it can recover the token and pass csrf_protect validation.","status":"published","published":"2026-07-14T17:07:32Z","modified":"2026-07-15T16:32:58Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:19:52.35951Z"}],"ghsa":[{"id":"GHSA-6cg9-7rr8-cvj2","title":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session...","description":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.\n\n_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.\n\nAn attacker able to query it can recover the token and pass csrf_protect validation.","status":"published","published":"2026-07-14T18:32:13Z","modified":"2026-07-15T18:32:50Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-204"],"updated_at":"2026-11-02T15:09:33.182129Z"}],"nvd":[{"id":"CVE-2026-15747","description":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.\n\n_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.\n\nAn attacker able to query it can recover the token and pass csrf_protect validation.","status":"published","published":"2026-07-14T18:17:12.587Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-204","CWE-352"],"updated_at":"2026-11-02T14:12:29.489525Z"}],"osv":[{"id":"CVE-2026-15747","title":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle","description":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.\n\n_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.\n\nAn attacker able to query it can recover the token and pass csrf_protect validation.","status":"published","published":"2026-07-14T17:07:32.593Z","modified":"2026-11-11T10:47:28.05870944Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-204","CWE-352"],"updated_at":"2026-11-11T03:22:00.901153Z"},{"id":"DEBIAN-CVE-2026-15747","description":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.  _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.  An attacker able to query it can recover the token and pass csrf_protect validation.","status":"published","published":"2026-07-14T18:17:12.587Z","modified":"2026-10-25T10:00:15.607497673Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"UBUNTU-CVE-2026-15747","description":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation.","status":"published","published":"2026-07-14T18:17:00Z","modified":"2026-10-17T12:58:06.229932536Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"AZL-92394","title":"CVE-2026-15747 affecting package perl-Mojolicious 8.57-3","description":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.\n\n_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.\n\nAn attacker able to query it can recover the token and pass csrf_protect validation.","status":"published","published":"2026-07-14T18:17:12Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.880689Z"},{"id":"MGASA-2026-0356","title":"Updated perl-Mojolicious packages fix a security vulnerability","description":"Mojolicious versions from 4.59 before 9.48 for Perl expose a stable\nrepresentation of the session CSRF token to a BREACH compression oracle.\n","status":"published","published":"2026-09-01T03:06:53Z","modified":"2026-09-01T03:15:03.395174286Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11282-1","title":"perl-Mojolicious-9.480.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Mojolicious-9.480.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-15T00:00:00Z","modified":"2026-07-16T10:00:14.973269713Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21451-1","title":"Security update for perl-Mojolicious","description":"This update for perl-Mojolicious fixes the following issues:\n\nChanges in perl-Mojolicious:\n\n- updated to 9.480.0 (9.48)\n    - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh\n      random value on every request, instead of being reused for the whole lifetime of a session.\n      CVE-2026-15747 bsc#1271431\n\n- updated to 9.470.0 (9.47)\n    - Added support for the QUERY HTTP request method from RFC 10008.\n    - Added query and query_p methods to Mojo::UserAgent.\n    - Added query method to Mojolicious::Routes::Route.\n    - Added query method to Mojolicious::Lite.\n    - Added query_ok method to Test::Mojo.\n    - Fixed a security issue where the pure-Perl implementation of Mojo::JSON could exhaust all available memory when\n      decoding deeply nested data. Decoding is now limited to 512 levels of nesting, to match the default of\n      Cpanel::JSON::XS.\n    - Fixed a memory leak in Morbo. (heikojansen)\n    - Fixed Mojo::File::list_tree to no longer follow symbolic links to directories.\n\n- updated to 9.460.0 (9.46)\n    - Added random_bytes function to Mojo::Util. (leont)\n    - Improved randomness for CSRF token generation. (leont)\n    - Fixed tls_options handling in Mojo::IOLoop::TLS. (krauro)\n    - Fixed spec compliance issue with attribute selectors in Mojo::DOM::CSS.\n\n- updated to 9.450.0 (9.45)\n    - Fixed portability issue in WebSocket tests.\n    - Fixed various spec compliance issues in Mojo::DOM.\n    - Fixed permessage-deflate support in Mojo::Transaction::WebSocket to be more interoperable with non-spec compliant\n      implementations.\n    - Fixed punycode roundtrip bug in Mojo::Util.\n    - Fixed Windows compatibility issues of Mojo::File::list_tree.\n\n- updated to 9.420.0 (9.42)\n    - Un-deprecated the spurt method in Mojo::File, it is now an alternative to spew.\n    - Removed experimental status from top-level await support in Mojo::Promise.\n    - Removed experimental status from encrypted session cookie support.\n    - Removed experimental status from persistent cookie support.\n    - Removed experimental status from samesite cookie support.\n    - Removed experimental status from colourful log messages.\n    - Removed experimental status from freeze option in Mojo::IOLoop.\n    - Removed experimental status from check and raise functions in Mojo::Exception.\n    - Fixed Cpanel::JSON::XS compatibility issues. (ilmari)\n    - Fixed async/await memory leak in Mojo::Promise. (TFBW)\n","status":"withdrawn","published":"2026-07-27T08:04:32Z","modified":"2026-07-31T14:01:33.665357923Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21496-1","title":"Security update for perl-Mojolicious","description":"This update for perl-Mojolicious fixes the following issues:\n\nChanges in perl-Mojolicious:\n\n- updated to 9.480.0 (9.48)\n    - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh\n      random value on every request, instead of being reused for the whole lifetime of a session.\n      CVE-2026-15747 bsc#1271431\n\n- updated to 9.470.0 (9.47)\n    - Added support for the QUERY HTTP request method from RFC 10008.\n    - Added query and query_p methods to Mojo::UserAgent.\n    - Added query method to Mojolicious::Routes::Route.\n    - Added query method to Mojolicious::Lite.\n    - Added query_ok method to Test::Mojo.\n    - Fixed a security issue where the pure-Perl implementation of Mojo::JSON could exhaust all available memory when\n      decoding deeply nested data. Decoding is now limited to 512 levels of nesting, to match the default of\n      Cpanel::JSON::XS.\n    - Fixed a memory leak in Morbo. (heikojansen)\n    - Fixed Mojo::File::list_tree to no longer follow symbolic links to directories.\n\n- updated to 9.460.0 (9.46)\n    - Added random_bytes function to Mojo::Util. (leont)\n    - Improved randomness for CSRF token generation. (leont)\n    - Fixed tls_options handling in Mojo::IOLoop::TLS. (krauro)\n    - Fixed spec compliance issue with attribute selectors in Mojo::DOM::CSS.\n\n- updated to 9.450.0 (9.45)\n    - Fixed portability issue in WebSocket tests.\n    - Fixed various spec compliance issues in Mojo::DOM.\n    - Fixed permessage-deflate support in Mojo::Transaction::WebSocket to be more interoperable with non-spec compliant\n      implementations.\n    - Fixed punycode roundtrip bug in Mojo::Util.\n    - Fixed Windows compatibility issues of Mojo::File::list_tree.\n\n- updated to 9.420.0 (9.42)\n    - Un-deprecated the spurt method in Mojo::File, it is now an alternative to spew.\n    - Removed experimental status from top-level await support in Mojo::Promise.\n    - Removed experimental status from encrypted session cookie support.\n    - Removed experimental status from persistent cookie support.\n    - Removed experimental status from samesite cookie support.\n    - Removed experimental status from colourful log messages.\n    - Removed experimental status from freeze option in Mojo::IOLoop.\n    - Removed experimental status from check and raise functions in Mojo::Exception.\n    - Fixed Cpanel::JSON::XS compatibility issues. (ilmari)\n    - Fixed async/await memory leak in Mojo::Promise. (TFBW)\n","status":"published","published":"2026-07-29T09:24:06Z","modified":"2026-07-31T18:24:10.713638894Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:4151-1","title":"Security update for perl-Mojolicious","description":"This update for perl-Mojolicious fixes the following issue:\n\n- CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH compression oracle\n  (bsc#1271431).\n","status":"published","published":"2026-09-14T08:03:13Z","modified":"2026-09-15T17:00:04.807567293Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}