openSUSE-SU-2026:21496-1: moderate: Security update for perl-Mojolicious

openSUSE security update: security update for perl-mojolicious
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21496-1
Rating: moderate
References:

  * bsc#1271431



Cross-References:

  * CVE-2026-15747



CVSS scores:

  * CVE-2026-15747 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
  * CVE-2026-15747 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves one vulnerability and has one bug fix can now be installed.

Description:

This update for perl-Mojolicious fixes the following issues:

Changes in perl-Mojolicious:

- updated to 9.480.0 (9.48)
    - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh
      random value on every request, instead of being reused for the whole lifetime of a session.
      CVE-2026-15747 bsc#1271431

- updated to 9.470.0 (9.47)
    - Added support for the QUERY HTTP request method from RFC 10008.
    - Added query and query_p methods to Mojo::UserAgent.
    - Added query method to Mojolicious::Routes::Route.
    - Added query method to Mojolicious::Lite.
    - Added query_ok method to Test::Mojo.
    - Fixed a security issue where the pure-Perl implementation of Mojo::JSON could exhaust all available memory when
      decoding deeply nested data. Decoding is now limited to 512 levels of nesting, to match the default of
      Cpanel::JSON::XS.
    - Fixed a memory leak in Morbo. (heikojansen)
    - Fixed Mojo::File::list_tree to no longer follow symbolic links to directories.

- updated to 9.460.0 (9.46)
    - Added random_bytes function to Mojo::Util. (leont)
    - Improved randomness for CSRF token generation. (leont)
    - Fixed tls_options handling in Mojo::IOLoop::TLS. (krauro)
    - Fixed spec compliance issue with attribute selectors in Mojo::DOM::CSS.

- updated to 9.450.0 (9.45)
    - Fixed portability issue in WebSocket tests.
    - Fixed various spec compliance issues in Mojo::DOM.
    - Fixed permessage-deflate support in Mojo::Transaction::WebSocket to be more interoperable with non-spec compliant
      implementations.
    - Fixed punycode roundtrip bug in Mojo::Util.
    - Fixed Windows compatibility issues of Mojo::File::list_tree.

- updated to 9.420.0 (9.42)
    - Un-deprecated the spurt method in Mojo::File, it is now an alternative to spew.
    - Removed experimental status from top-level await support in Mojo::Promise.
    - Removed experimental status from encrypted session cookie support.
    - Removed experimental status from persistent cookie support.
    - Removed experimental status from samesite cookie support.
    - Removed experimental status from colourful log messages.
    - Removed experimental status from freeze option in Mojo::IOLoop.
    - Removed experimental status from check and raise functions in Mojo::Exception.
    - Fixed Cpanel::JSON::XS compatibility issues. (ilmari)
    - Fixed async/await memory leak in Mojo::Promise. (TFBW)


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-447=1

Package List:

- openSUSE Leap 16.0:

  perl-Mojolicious-9.480.0-bp160.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-15747.html