{"id":"CVE-2026-77568","aliases":["EUVD-2026-83035","GHSA-cf46-h6jw-mj3r","UBUNTU-CVE-2026-77568","openSUSE-SU-2026:21956-1"],"status":"rejected","title":"Mojolicious: CSRF tokens are vulnerable to BREACH attacks","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","from":"euvd"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-352"],"published":"2026-09-18T16:08:38Z","modified":"2026-09-25T18:27:24Z","affected":[{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Mojolicious","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.480.0-bp160.2.1"}]}],"bundled":2}],"references":[{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77568.json","tags":["advisory"]},{"url":"https://github.com/mojolicious/mojo/security/advisories/GHSA-cf46-h6jw-mj3r","tags":["advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77568","tags":["advisory"]},{"url":"https://github.com/mojolicious/mojo/commit/01921fbbbbeca2d1397e082d4a647f9b84c24e27","tags":["fix","report"]},{"url":"https://ubuntu.com/security/CVE-2026-77568","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77568","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281637","tags":["report"]},{"url":"https://bugzilla.suse.com/1281638","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77568","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-77568","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.","status":"rejected","published":"2026-09-18T16:08:38.846Z","modified":"2026-09-21T17:51:20.075Z","updated_at":"2026-11-02T14:20:15.712761Z"}],"euvd":[{"id":"EUVD-2026-83035","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.","status":"published","published":"2026-09-18T16:08:38Z","modified":"2026-09-21T17:51:20Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:05.032636Z"}],"nvd":[{"id":"CVE-2026-77568","description":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.","status":"rejected","published":"2026-09-18T16:17:09.307Z","modified":"2026-09-21T18:17:10.83Z","updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"CVE-2026-77568","title":"Mojolicious: CSRF tokens are vulnerable to BREACH attacks","description":"Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.","status":"published","published":"2026-09-18T16:08:38.846Z","modified":"2026-09-25T18:27:24.835767726Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-200","CWE-352"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"UBUNTU-CVE-2026-77568","description":"Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.","status":"withdrawn","published":"2026-09-21T00:00:00Z","modified":"2026-09-24T02:00:47.220886662Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"openSUSE-SU-2026:21956-1","title":"Security update for perl-Mojolicious","description":"This update for perl-Mojolicious fixes the following issues:\n\nChanges in perl-Mojolicious:\n\n- Adding missing CVE references already fixed in the past:\n    CVE-2026-77568 bsc#1281638, CVE-2026-68914 bsc#1281637.\n","status":"published","published":"2026-09-24T14:35:04Z","modified":"2026-09-25T18:23:15.136881189Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}