CVE-2026-77568

Name of the Vulnerable Software and Affected Versions Mojolicious versions prior to 9.48

Description The CSRF helpers csrf field(), csrf token(), and csrf protect() reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker can use a BREACH compression side channel—a technique that recovers secrets by observing the size of compressed HTTP responses—to recover the token and forge cross-site requests. API-only deployments that do not render the token in HTML are not affected.

Recommendations Update to version 9.48.