328 matches found
Medium: perl-Mojolicious
Issue Overview: Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path decodevalue dispatching to decodearray and decodeobject recurses with no depth limit, so a small deeply nested JSON document can consume...
Amazon Linux 2023 : perl-Mojolicious, perl-Test-Mojo (ALAS2023-2026-3209)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3209 advisory. Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path decodevalue dispatching to decodearray and...
Security update for perl-Mojolicious (important)
openSUSE security update: security update for perl-mojolicious ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21956-1 Rating: important References: bsc1281637 bsc1281638 Cross-References: CVE-2026-68914 CVE-2026-77568 CVSS scores: CVE-2026-68914 SU...
OPENSUSE-SU-2026:21956-1 Security update for perl-Mojolicious
This update for perl-Mojolicious fixes the following issues: Changes in perl-Mojolicious: - Adding missing CVE references already fixed in the past: CVE-2026-77568 bsc1281638, CVE-2026-68914 bsc1281637...
OPENSUSE-SU-2026:11850-1 perl-Mojolicious-9.490.0-2.1 on GA media
These are all security issues fixed in the perl-Mojolicious-9.490.0-2.1 package on the GA media of openSUSE Tumbleweed...
UBUNTU-CVE-2026-68914
Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nest...
UBUNTU-CVE-2026-77568
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...
CVE-2026-68914
Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nest...
CVE-2026-77568
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...
CVE-2026-77568
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate...
CVE-2026-68914
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate...
CVE-2026-77568
This CVE entry is rejected and does not represent an active vulnerability entry.
CVE-2026-77568 Mojolicious: CSRF tokens are vulnerable to BREACH attacks
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...
CVE-2026-77568 Mojolicious: CSRF tokens are vulnerable to BREACH attacks
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...
EUVD-2026-83035
Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrffield, csrftoken, and csrfprotect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an...
CVE-2026-68914
CVE-2026-68914 is a duplicate of CVE-2026-14803 . The underlying vulnerability affects the Mojolicious Perl web framework, specifically the pure-Perl implementation of Mojo::JSON prior to version 9.47 . When Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled, the decoder does not limit...
EUVD-2026-83031
Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nest...
CVE-2026-68914 Mojolicious pure-Perl Mojo::JSON decoder allows memory exhaustion via deeply nested data
Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nest...