CVE-2026-9537

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-9537
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9537.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-9537
Downstream
Published
2026-07-17T15:29:58.088Z
Modified
2026-07-19T03:45:47.741851449Z
Summary
Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison
Details

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison.

The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes.

A caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9537.json",
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-208"
    ]
}
References

Affected packages

Git / github.com/jberger/mojo-jwt

Affected ranges

Type
GIT
Repo
https://github.com/jberger/mojo-jwt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b8aefb846613e44b5b12bc170898ffd5b05094a2
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.02"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.01
0.02
0.03
0.04
0.05
0.06
0.07
0.08
0.09
1.*
1.00
1.01

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9537.json"