CVE-2026-15747
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in the Mojolicious library for Perl (versions 4.59 through 9.48) exposes a stable CSRF token representation to a BREACH compression oracle. The token is generated once per session and placed in a hidden `csrf_token` field, and when the response echoes attacker-controlled input and is gzip-compressed, the token can be recovered.
Risk Assessment
An attacker can recover the CSRF token and bypass csrf_protect validation, leading to unauthorized actions on behalf of an authenticated user, such as data modification or privilege escalation.
Recommendation
Upgrade Mojolicious to version 9.48 or later immediately. Additionally, consider disabling gzip compression for responses containing sensitive data or implementing BREACH attack mitigations.
Original NVD description (English source)
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation.