Mojolicious vulnerabilities

2 known vulnerabilities in Mojolicious from SRI. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Mojolicious: Observable Response Discrepancy

  CVE-2026-15747Jul 14, 2026SRI

  Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places

• 8.1 High severity

  Mojolicious: Use of Hard-coded Cryptographic Key

  CVE-2024-58134May 3, 2025SRI

  Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who know