CVE-2026-9537

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes. A caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/jberger/Mojo-JWT/commit/b8aefb846613e44b5b12bc170898ffd5b05094a2.patch
http://www.openwall.com/lists/oss-security/2026/07/17/11

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Mojo::JWT anteriores a la 1.02 para Perl verifican las firmas HMAC con una comparación de cadenas de tiempo no constante. El método decode() compara la firma proporcionada con el HMAC recalculado utilizando el operador eq de Perl, que se detiene en el primer byte diferente, por lo que el tiempo de comparación varía con el número de bytes iniciales coincidentes. Un llamador que decodifica tokens proporcionados por el atacante filtra la firma esperada a través de esta variación de tiempo, la cual puede agregarse a lo largo de muchas solicitudes para recuperar la firma y falsificar un token.

Information

Published : 2026-07-17 16:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-9537

Mitre link : CVE-2026-9537

CVE.ORG link : CVE-2026-9537

JSON object : View

Products Affected

No product.

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2026-9537", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9537", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T19:37:00.356255Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "http://github.com/jberger/Mojo-JWT", "vendor": "JBERGER", "product": "Mojo::JWT", "versions": [{"status": "affected", "version": "0", "lessThan": "1.02", "versionType": "custom"}], "packageName": "Mojo-JWT", "programFiles": ["lib/Mojo/JWT.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Mojo::JWT::decode"}]}]}], "published": "2026-07-17T16:17:20.417", "references": [{"url": "https://github.com/jberger/Mojo-JWT/commit/b8aefb846613e44b5b12bc170898ffd5b05094a2.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/17/11", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison.\n\nThe decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes.\n\nA caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token."}, {"lang": "es", "value": "Las versiones de Mojo::JWT anteriores a la 1.02 para Perl verifican las firmas HMAC con una comparaci\u00f3n de cadenas de tiempo no constante.\n\nEl m\u00e9todo decode() compara la firma proporcionada con el HMAC recalculado utilizando el operador eq de Perl, que se detiene en el primer byte diferente, por lo que el tiempo de comparaci\u00f3n var\u00eda con el n\u00famero de bytes iniciales coincidentes.\n\nUn llamador que decodifica tokens proporcionados por el atacante filtra la firma esperada a trav\u00e9s de esta variaci\u00f3n de tiempo, la cual puede agregarse a lo largo de muchas solicitudes para recuperar la firma y falsificar un token."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}