CVE catalog

CVE-2026-9537

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq op

[CVE catalog]

Severity
High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes. A caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibmojo-jwt-perlsid1.02-1fixed
Debianlibmojo-jwt-perlforky1.02-1fixed
Debianlibmojo-jwt-perltrixie1.01-1vulnerable
Debianlibmojo-jwt-perlbookworm0.09-1vulnerable
Cpelibmojo-jwt-perlNot reportedNot reportedvulnerable
Opensuseperl-Mojo-JWTtumbleweed1.20.0-2.1fixed
Ubuntulibmojo-jwt-perl18.040.05-1vulnerable
Ubuntulibmojo-jwt-perl20.040.08-1vulnerable
Ubuntulibmojo-jwt-perl22.040.09-1vulnerable
Ubuntulibmojo-jwt-perl24.040.09-1vulnerable
Ubuntulibmojo-jwt-perl26.041.01-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibmojo-jwt-perlsourcesid1.02-1not yet assignedNot reportedNot reported
Debianlibmojo-jwt-perlsourceforky1.02-1not yet assignedNot reportedNot reported
Debianlibmojo-jwt-perlsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibmojo-jwt-perlsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Opensuseperl-Mojo-JWTrpmtumbleweed1.20.0-2.1Not reportedOPENSUSE-SU-2026:11450-1Not reported

Notes

[trixie] libmojo-jwt-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libmojo-jwt-perl]Affected
    Details (2)

    • 0.09-1 · all · bookworm

      Affected

      nvd · libmojo-jwt-perl · debian · bookworm; nvd · libmojo-jwt-perl · debian · 12

    • 0.09-1 · all · bookworm

      Affected

      nvd · libmojo-jwt-perl · debian · bookworm; nvd · libmojo-jwt-perl · debian · 12

[Debian 13 (Trixie)]

  • [libmojo-jwt-perl]Affected
    Details (2)

    • 1.01-1 · all · trixie

      Affected

      nvd · libmojo-jwt-perl · debian · 13

    • 1.01-1 · all · trixie

      Affected

      nvd · libmojo-jwt-perl · debian · 13

[openSUSE Tumbleweed]

  • [perl-Mojo-JWT]Fixed

    Source package: [perl-Mojo-JWT]

    Details (1)

    • 1.20.0-2.1 · noarch · tumbleweed

      Fixed · Fixed: 1.20.0-2.1

      nvd · perl-Mojo-JWT · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]