CVE-2026-77568: Mojolicious: CSRF tokens are vulnerable to BREACH attacks
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mojoliciousto a version that resolves this vulnerability.Fixed in 9.48 - Compensating control
If using Mojolicious CSRF helpers, prevent BREACH by ensuring response compression is not enabled when attacker-influenced content can be reflected in the same response (e.g., disable response compression for those responses) so the per-session CSRF token cannot be recovered via compression side-channel.
Event History
Frequently Asked Questions
Which deployments are not affected?
API-only deployments that never render Mojolicious CSRF tokens in HTML are not affected.
What conditions are required for exploitation?
The application must render a reused per-session CSRF token in HTML, enable response compression, and reflect attacker-influenced content in the same response. The attacker must be able to induce many victim requests and observe response sizes; no authentication is required.
How can I determine whether an application is exposed?
Check whether it uses Mojolicious versions prior to 9.48 and the csrf_field, csrf_token, or csrf_protect helpers in rendered HTML. Exposure additionally depends on response compression and attacker-controlled reflected content being present in those responses.
What is the available fix?
Upgrade Mojolicious to version 9.48, which fixes the issue.