CVE-2026-15747

Katalog CVE

CVSS 9.1 · Critical EPSS 0,25%

Kerentanan Observable Response Discrepancy. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

15 Juli 2026

Status NVD

Deferred

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy
CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/mojolicious/mojo/commit/01921fbbbbeca2d1397e082d4a647f9b84c24e27.patch
• https://metacpan.org/release/SRI/Mojolicious-9.48/changes
• http://www.openwall.com/lists/oss-security/2026/07/14/16