Cross-Site Request Forgery Flaw in Mojolicious Web Framework
CVE-2026-77568

4.2MEDIUM

Key Information:

Vendor

Mojolicious

Status
Mojo
Vendor
CVE Published:
18 September 2026

What is CVE-2026-77568?

Mojolicious, a popular real-time web framework for Perl, has a vulnerability in its Cross-Site Request Forgery (CSRF) helpers—csrf_field, csrf_token, and csrf_protect. In versions prior to 9.48, these helpers reuse a per-session token that remains unchanged in rendered HTML. If response compression is enabled and an attacker manipulates certain content within the response, it opens a potential side-channel attack via the BREACH exploit. This allows an unauthenticated attacker to recover the CSRF token when monitoring the size of responses from multiple requests, which could lead to forged cross-site requests. It's important to note that API-only deployments which do not reflect the token in HTML are not impacted by this issue. The vulnerability has been addressed in Mojolicious version 9.48.

Affected Version(s)

mojo < 9.48

References

https://github.com/mojolicious/mojo/security/advisories/G...
x_refsource_CONFIRM
https://github.com/mojolicious/mojo/commit/01921fbbbbeca2...
x_refsource_MISC

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.