CVE-2026-15747CWE-204CWE-352

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

Critical · published July 14, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrf_protect validation.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00250 · 15.4th percentile
Weaknesses
CWE-204 · Observable Response Discrepancy; CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-07-14T17:07Z
EPSS history
Timeline
  • 14 JUL 17:07Z
    Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle
    cvelistv5