Riskcovery

CVE-2026-15747

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

State
Published
Severity
9.1 Critical
Published
Jul 14, 2026
Updated
Jul 15, 2026
Reserved
Jul 14, 2026

Read the record on cve.org

Description

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrf_protect validation.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCISA-ADP

Weaknesses

  • CWE-204 Observable Response Discrepancy
  • CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

ProductVersions
MojoliciousSRI
  • 4.59 to before 9.48Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.