CVE-2026-15747

Name of the Vulnerable Software and Affected Versions Mojolicious versions 4.59 through 9.47

Description The software exposes a stable representation of the session CSRF token to a BREACH compression oracle. This occurs because the csrf token() function generates and caches one token per session, returning the same value on every call, while the csrf field() function places that value in a hidden csrf token input. When a response containing the token also echoes attacker-controlled input and is gzip-compressed, the resulting compressed lengths create a BREACH oracle, allowing an attacker to recover the token and bypass csrf protect() validation. BREACH is a side-channel attack that exploits HTTP compression to extract sensitive data from encrypted responses.

Recommendations Update Mojolicious to version 9.48 or later.