CVE-2026-77568
MediumCVSS 4.2Summary
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.
Risk Assessment
An attacker can recover the CSRF token and forge cross-site requests on behalf of the victim, potentially leading to unauthorized actions in the application.
Recommendation
Update Mojolicious to version 9.48 or later.
Other vulnerabilities in Mojolicious
See all- CVE-2026-68914High
Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled. An attacker who can supply untrusted JSON to decode_json, from_json, or j can submit deeply nested arrays or objects, causing unbounded recursion, memory exhaustion, and a process crash. Applications using the Cpanel::JSON::XS backend are not affected because that backend already enforces a nesting limit. This issue is fixed in version 9.47.
- CVE-2026-15747Critical
A vulnerability in the Mojolicious library for Perl (versions 4.59 through 9.48) exposes a stable CSRF token representation to a BREACH compression oracle. The token is generated once per session and placed in a hidden `csrf_token` field, and when the response echoes attacker-controlled input and is gzip-compressed, the token can be recovered.
Original NVD description (English source)
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.