Mojolicious CVE-2026-15747

Exploitation requires all of: (1) the target Mojolicious app uses the built-in CSRF helpers so that the same static per-session token is emitted repeatedly (pre-9.48 behavior); (2) responses carrying the csrf_token field are gzip/deflate-compressed; (3) the same response reflects attacker-controlled input adjacent to the token; and (4) the attacker can observe compressed response lengths and induce many adaptive requests from the victim's authenticated session (an on-path/traffic-observation capability). Limiting factors: if response compression is disabled, if no attacker input is reflected into token-bearing pages, or if the attacker cannot measure response sizes, the oracle collapses and the attack fails. The CVSS UI:N/AC:L rating understates these multi-request, chosen-input, side-channel prerequisites - verify against the actual app's compression and reflection behavior.

Signals are mixed and warrant nuance. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.1, C:H/I:H) portrays a trivially exploitable network flaw, but this understates the real preconditions: a practical BREACH attack requires HTTP response compression to be enabled, an endpoint that reflects attacker-controlled input into the same compressed response as the token, and an observation position to measure ciphertext lengths across many adaptively chosen requests - conditions that make attack complexity genuinely high and that argue for AC:H and user/traffic interaction rather than AC:L/UI:N. EPSS is low (0.15%, 5th percentile) and there is no KEV listing and no public POC, consistent with a theoretically serious but operationally demanding attack. SSVC flags Automatable:yes and Technical Impact:total, which is why it should not be dismissed. Net: real but conditional priority - patch on a normal cycle, prioritize sooner for internet-facing apps that compress responses and reflect user input near the CSRF field.

An attacker who can observe a victim's TLS-encrypted traffic sizes (e.g., shared network or on-path) lures the victim's authenticated browser into repeatedly requesting a compressed page that both reflects an attacker-chosen string and includes the hidden csrf_token field. By adaptively varying the injected string and watching the compressed response shrink when a guess matches, the attacker recovers the full static token and submits a forged state-changing request that passes csrf_protect. No public POC is identified at time of analysis, but the technique follows the well-documented BREACH methodology and the fixed code confirms the static-token weakness.