CVE-2026-15747: Mojolicious 4.59 to before 9.48

CVE-2026-15747. CVSS 3.1 base score 9.1 (CRITICAL, Source advisory). EPSS 0.0025 (percentile 0.15438), scored 24-Oct-2026.

Affected technology

Mojolicious · 4.59 to before 9.48
SRI

Description’s affected range: versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call

Component: Not specified by the source
Function: Mojolicious::Plugin::DefaultHelpers::_csrf_token
File: lib/Mojolicious/Plugin/DefaultHelpers.pm, lib/Mojolicious/Plugin/TagHelpers.pm, lib/Mojolicious/Renderer.pm

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 9.1/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 25-Oct-2026 01:29 UTC

CWE: CWE-204, CWE-352
CCR priority: 36.5 /100 (P4)
CVSS 3.1: 9.1 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · Source advisory
EPSS: 0.0025 · percentile 0.15438 · 2026-10-24
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-15747.html