What is the CVSS score of CVE-2026-15747?

CVE-2026-15747 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Mojolicious are affected by CVE-2026-15747?

Perl Mojolicious web framework versions 4.59-9.47 contain a critical vulnerability (CVSS 9.1) that allows attackers to hijack user sessions by bypassing CSRF token protections through a…. A patch is available.

How to fix or mitigate CVE-2026-15747?

Within 24 hours, inventory all systems running Mojolicious and identify instances in versions 4.59 through 9.47. Within 7 days, upgrade all affected deployments to Mojolicious 9.48 or later per vendor advisory. Within 30 days, complete full testing and validation that the upgrade resolves the vulnerability without introducing application regressions, and document patch completion for audit records.

Mojolicious CVE-2026-15747

EUVD-2026-44067 CRITICAL

Observable Response Discrepancy (CWE-204)

2026-07-14 CPANSec

GHSA-6cg9-7rr8-cvj2

CSRF Oracle Mojolicious Suse

Critical

Disputed · 9.1 Vendor: CPANSec

Severity by source

Sources disagree (Medium–Critical)

Vendor (CPANSec) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.9 MEDIUM

BREACH needs compression plus reflected input and a traffic-size oracle over many victim-driven requests (AC:H, UI:R); impact is CSRF bypass (I:H) with only token disclosure (C:L).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 19:31 vuln.today

Analysis Generated

Jul 15, 2026 - 19:31 vuln.today

CVSS changed

Jul 15, 2026 - 17:22 NVD

9.1 (CRITICAL)

CVE Published

Jul 14, 2026 - 17:07 cve.org

CRITICAL 9.1

CVE Published

Jul 14, 2026 - 17:07 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden csrf_token input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrf_protect validation.

AnalysisAI

CSRF token disclosure in the Perl Mojolicious web framework (versions 4.59 up to but not including 9.48) allows a network attacker to recover a victim's session CSRF token via a BREACH compression side channel and then bypass csrf_protect validation. Because _csrf_token cached and returned one stable per-session value that _csrf_field embedded in every response, an attacker who could inject reflected input into a gzip-compressed page could iteratively guess the token by observing compressed response lengths. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and it is not in CISA KEV, but SSVC rates technical impact as total and automatable as yes.

Technical ContextAI

Mojolicious is a widely used real-time Perl web framework (CPE cpe:2.3:a:sri:mojolicious). The flaw is a CWE-204 (Observable Response Discrepancy) instance realized as a BREACH-class oracle. BREACH exploits HTTP-level compression (gzip/deflate): when a secret and attacker-controlled input coexist in the same compressed response, the compressor deduplicates matching byte sequences, so a correct partial guess shrinks the compressed length. The pre-fix _csrf_token helper generated one token per session (unpack "H*", random_bytes(20)) and returned that identical 40-hex value on every call, and _csrf_field placed it in a hidden csrf_token input - giving the oracle a stable target to converge on character by character. The vendor fix (commit 01921fb, released in 9.48) masks the token with a fresh random 20-byte value on every request, emitting an 80-hex string (mask concatenated with mask XOR token) that changes each response while still unmasking to the same session token during validation via secure_compare.

RemediationAI

Vendor-released patch: 9.48 - upgrade Mojolicious to 9.48 or later, where CSRF tokens are masked with a fresh random value on every request (commit https://github.com/mojolicious/mojo/commit/01921fbbbbeca2d1397e082d4a647f9b84c24e27.patch). If immediate upgrade is not possible, reduce the BREACH oracle by disabling HTTP response compression (gzip/deflate) on responses that contain the CSRF token, at the cost of increased bandwidth and latency; alternatively ensure attacker-controlled input is never reflected into the same compressed response as the csrf_token field, and consider rate-limiting or length-masking (random padding) on token-bearing pages. Each mitigation has trade-offs: disabling compression hurts performance site-wide, and reflection audits are error-prone, so upgrading to 9.48 is strongly preferred. See the advisory at https://seclists.org/oss-sec/2026/q3/146 and release changes at https://metacpan.org/release/SRI/Mojolicious-9.48/changes.