CVE-2026-77568: Mojolicious: CSRF tokens are vulnerable to BREACH attacks
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mojoliciousto a version that resolves this vulnerability.Fixed in 9.48 - Compensating control
If you use Mojolicious response compression, mitigate BREACH by ensuring attacker-influenced reflected content and CSRF-protected responses are not compressed together (e.g., disable response compression for CSRF-bearing responses / avoid compression when attacker-controlled content is reflected in the same response).
Event History
Frequently Asked Questions
Which deployments are not affected?
API-only deployments that never render Mojolicious CSRF tokens in HTML are not affected.
What conditions are required for exploitation?
The application must render a reused per-session CSRF token in HTML, enable response compression, and reflect attacker-influenced content in the same response. The attacker must be able to induce many victim requests and observe response sizes; no authentication is required.
How can I determine whether an application is exposed?
Check whether it uses Mojolicious versions prior to 9.48 and the csrf_field, csrf_token, or csrf_protect helpers in rendered HTML. Exposure additionally depends on response compression and attacker-controlled reflected content being present in those responses.
What is the available fix?
Upgrade Mojolicious to version 9.48, which fixes the issue.