CVE-2026-15747: Mojolicious for Perl CSRF Vulnerability

CVE-2026-15747 Overview

CVE-2026-15747 affects Mojolicious versions from 4.59 before 9.48 for Perl. The framework exposes a stable representation of the session Cross-Site Request Forgery (CSRF) token to a Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext (BREACH) compression oracle. The _csrf_token helper generates and caches one token per session and returns the same value on every call. When responses that contain the token also echo attacker-controlled input and are gzip-compressed, the compressed response length becomes a side channel. An attacker able to query the endpoint repeatedly can recover the token character by character and pass csrf_protect validation.

Critical Impact
Attackers can recover session CSRF tokens through compressed responses and bypass CSRF protection to perform authenticated state-changing actions on behalf of victims.

Affected Products

Mojolicious for Perl versions 4.59 through 9.47
Applications using _csrf_token and _csrf_field helpers
Mojolicious deployments serving gzip-compressed responses that reflect user input

Discovery Timeline

2026-07-14 - CVE-2026-15747 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15747

Vulnerability Analysis

The vulnerability is a side-channel information disclosure classified as [CWE-204] Observable Response Discrepancy. Mojolicious binds a single CSRF token to a session for its entire lifetime. Every call to _csrf_token returns the cached value, and _csrf_field embeds that value into a hidden csrf_token HTML input. When the same response also reflects attacker-controlled input and is transmitted over HTTP compression, an adversary can perform a BREACH-style attack by observing ciphertext length variations across many chosen-plaintext requests. Each guess that shares a longer prefix with the token compresses more efficiently, producing a shorter response. Iterating this process reveals the token one byte at a time.

Root Cause

The token was reused across requests instead of being masked per response. This static representation of secret material inside a compressed body containing attacker-influenced content is the exact precondition required by BREACH. The fix in Mojolicious 9.48 masks the token with a fresh random value on every request, so the wire representation changes even though the underlying session token remains stable for validation.

Attack Vector

Exploitation requires no authentication and only network access to a vulnerable endpoint that (1) renders the CSRF token, (2) reflects attacker-controlled input, and (3) is served with HTTP compression. The attacker forces the victim's browser or an intermediary to issue many requests with adaptively chosen input and observes compressed response sizes. After token recovery, the attacker submits a forged request containing the valid token to defeat csrf_protect.

text

9.48  UNRELEASED
+  - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh
+    random value on every request, instead of being reused for the whole lifetime of a session.

9.47  2026-07-05
  - Added support for the QUERY HTTP request method from RFC 10008.

Source: GitHub Commit Patch

Detection Methods for CVE-2026-15747

Indicators of Compromise

High-volume, near-identical requests to endpoints that render forms containing csrf_token, often differing by a single character in a query or form parameter.
Repeated requests originating from the same client or proxy chain that iterate through candidate token prefixes.
Successful state-changing POST requests carrying a valid csrf_token value that was never issued in a rendered form to that client session.

Detection Strategies

Inventory Perl web applications and identify Mojolicious versions between 4.59 and 9.47 using CPAN metadata or perl -MMojolicious -e 'print $Mojolicious::VERSION'.
Inspect application routes for pages that both include _csrf_field output and echo user-controlled query, header, or form parameters into the response body.
Alert on anomalous request rates against form-rendering endpoints combined with Accept-Encoding: gzip and length-based response deltas.

Monitoring Recommendations

Log outbound Content-Length and Content-Encoding per response and baseline expected sizes for form endpoints.
Rate-limit reflection endpoints and monitor for scripted patterns consistent with adaptive compression oracle probing.
Track successful CSRF-protected submissions against the issuing session and flag mismatches between token issuance and use.

How to Mitigate CVE-2026-15747

Immediate Actions Required

Upgrade Mojolicious to version 9.48 or later, which masks the CSRF token per request.
Audit templates for endpoints that reflect user input alongside _csrf_field output and remove unnecessary reflection.
Disable HTTP compression on responses that contain the CSRF token until the upgrade is deployed.

Patch Information

The upstream fix is available in Mojolicious 9.48. The patch modifies token rendering so each response embeds a masked value derived from a fresh random component, while csrf_protect still validates against the session-bound secret. Review the MetaCPAN Release Changes and the GitHub Commit Patch for full details. Additional discussion is available in the OpenWall OSS-Security Discussion.

Workarounds

Strip or refuse Accept-Encoding: gzip on responses that render csrf_token at the reverse proxy layer.
Remove reflection of attacker-controlled input from pages that embed CSRF tokens.
Add per-request rate limits and bot detection on form-rendering endpoints to raise the cost of oracle queries.

bash

# Upgrade Mojolicious to a fixed release
cpanm Mojolicious@9.48

# Verify installed version
perl -MMojolicious -e 'print $Mojolicious::VERSION, "\n"'

# Nginx: disable gzip for responses containing CSRF-bearing forms
# (place inside the relevant location block)
gzip off;