CVE-2026-15747 Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "packageName": "Mojolicious",
    "product": "Mojolicious",
    "programFiles": [
      "lib/Mojolicious/Plugin/DefaultHelpers.pm",
      "lib/Mojolicious/Plugin/TagHelpers.pm",
      "lib/Mojolicious/Renderer.pm"
    ],
    "programRoutines": [
      {
        "name": "Mojolicious::Plugin::DefaultHelpers::_csrf_token"
      }
    ],
    "repo": "https://github.com/mojolicious/mojo",
    "vendor": "SRI",
    "versions": [
      {
        "lessThan": "9.48",
        "status": "affected",
        "version": "4.59",
        "versionType": "custom"
      }
    ]
  }
]