PUBLISHED
2026-07-14 18:17
MODIFIED
2026-07-14 18:17
EPSS (Prob. Exploit)
0.25%
Top 84.6%
> DESCRIPTION
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.
_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.
An attacker able to query it can recover the token and pass csrf_protect validation.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-204: Observable Response Discrepancy - The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. | CWE-352: Cross-Site Request Forgery - The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle
AFFECTED PACKAGES:
Unknown / Unknown
398 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
14/07/2026 18:17
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-204: Observable Response Discrepancy - The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intend...
Nouvelle valeur:
CWE-204: Observable Response Discrepancy - The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intend...
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-204: Observable Response Discrepancy - The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intend...
Total des modifications: 2
Dernière mise à jour: 5 days ago