SRI Mojolicious

• CVE-2026-15747 Critical 9.1 Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle 0.2%
• CVE-2024-58134 High 8.1 Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default 0.6%
• CVE-2024-58135 Medium 5.3 Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default 0.6%