Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has…
Priority MEDIUM 47CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.
Why it matters now
EPSS 0.02029 81st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 58
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:*:*:* | up to 0.999926 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.2:*:*:*:*:*:*:* | 0.2 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.3:*:*:*:*:*:*:* | 0.3 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.4:*:*:*:*:*:*:* | 0.4 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.5:*:*:*:*:*:*:* | 0.5 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.6:*:*:*:*:*:*:* | 0.6 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.7:*:*:*:*:*:*:* | 0.7 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.8:*:*:*:*:*:*:* | 0.8 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.8.1:*:*:*:*:*:*:* | 0.8.1 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.8.2:*:*:*:*:*:*:* | 0.8.2 | Vulnerable | Mojolicious |
- cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:*:*:* Versions up to 0.999926 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.8.2:*:*:*:*:*:*:* Versions 0.8.2 Vulnerable ·Mojolicious
Show 48 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mojolicious:mojolicious:0.8.3:*:*:*:*:*:*:* | 0.8.3 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.8.4:*:*:*:*:*:*:* | 0.8.4 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.8.5:*:*:*:*:*:*:* | 0.8.5 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.9:*:*:*:*:*:*:* | 0.9 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.8006:*:*:*:*:*:*:* | 0.8006 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.8007:*:*:*:*:*:*:* | 0.8007 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.8008:*:*:*:*:*:*:* | 0.8008 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.8009:*:*:*:*:*:*:* | 0.8009 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.9001:*:*:*:*:*:*:* | 0.9001 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.9002:*:*:*:*:*:*:* | 0.9002 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991231:*:*:*:*:*:*:* | 0.991231 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991232:*:*:*:*:*:*:* | 0.991232 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991233:*:*:*:*:*:*:* | 0.991233 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991234:*:*:*:*:*:*:* | 0.991234 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991235:*:*:*:*:*:*:* | 0.991235 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991236:*:*:*:*:*:*:* | 0.991236 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991237:*:*:*:*:*:*:* | 0.991237 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991238:*:*:*:*:*:*:* | 0.991238 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991239:*:*:*:*:*:*:* | 0.991239 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991240:*:*:*:*:*:*:* | 0.991240 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991241:*:*:*:*:*:*:* | 0.991241 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991242:*:*:*:*:*:*:* | 0.991242 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991243:*:*:*:*:*:*:* | 0.991243 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991244:*:*:*:*:*:*:* | 0.991244 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991245:*:*:*:*:*:*:* | 0.991245 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991246:*:*:*:*:*:*:* | 0.991246 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991250:*:*:*:*:*:*:* | 0.991250 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.991251:*:*:*:*:*:*:* | 0.991251 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999901:*:*:*:*:*:*:* | 0.999901 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999902:*:*:*:*:*:*:* | 0.999902 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999903:*:*:*:*:*:*:* | 0.999903 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999904:*:*:*:*:*:*:* | 0.999904 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999905:*:*:*:*:*:*:* | 0.999905 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999906:*:*:*:*:*:*:* | 0.999906 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999907:*:*:*:*:*:*:* | 0.999907 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999908:*:*:*:*:*:*:* | 0.999908 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999909:*:*:*:*:*:*:* | 0.999909 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999910:*:*:*:*:*:*:* | 0.999910 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999911:*:*:*:*:*:*:* | 0.999911 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999912:*:*:*:*:*:*:* | 0.999912 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999913:*:*:*:*:*:*:* | 0.999913 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999914:*:*:*:*:*:*:* | 0.999914 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999920:*:*:*:*:*:*:* | 0.999920 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999921:*:*:*:*:*:*:* | 0.999921 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999922:*:*:*:*:*:*:* | 0.999922 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999923:*:*:*:*:*:*:* | 0.999923 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999924:*:*:*:*:*:*:* | 0.999924 | Vulnerable | Mojolicious |
| cpe:2.3:a:mojolicious:mojolicious:0.999925:*:*:*:*:*:*:* | 0.999925 | Vulnerable | Mojolicious |
- cpe:2.3:a:mojolicious:mojolicious:0.8.3:*:*:*:*:*:*:* Versions 0.8.3 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.8.4:*:*:*:*:*:*:* Versions 0.8.4 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.8.5:*:*:*:*:*:*:* Versions 0.8.5 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.8006:*:*:*:*:*:*:* Versions 0.8006 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.8007:*:*:*:*:*:*:* Versions 0.8007 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.8008:*:*:*:*:*:*:* Versions 0.8008 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.8009:*:*:*:*:*:*:* Versions 0.8009 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.9001:*:*:*:*:*:*:* Versions 0.9001 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.9002:*:*:*:*:*:*:* Versions 0.9002 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991231:*:*:*:*:*:*:* Versions 0.991231 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991232:*:*:*:*:*:*:* Versions 0.991232 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991233:*:*:*:*:*:*:* Versions 0.991233 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991234:*:*:*:*:*:*:* Versions 0.991234 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991235:*:*:*:*:*:*:* Versions 0.991235 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991236:*:*:*:*:*:*:* Versions 0.991236 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991237:*:*:*:*:*:*:* Versions 0.991237 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991238:*:*:*:*:*:*:* Versions 0.991238 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991239:*:*:*:*:*:*:* Versions 0.991239 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991240:*:*:*:*:*:*:* Versions 0.991240 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991241:*:*:*:*:*:*:* Versions 0.991241 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991242:*:*:*:*:*:*:* Versions 0.991242 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991243:*:*:*:*:*:*:* Versions 0.991243 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991244:*:*:*:*:*:*:* Versions 0.991244 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991245:*:*:*:*:*:*:* Versions 0.991245 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991246:*:*:*:*:*:*:* Versions 0.991246 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991250:*:*:*:*:*:*:* Versions 0.991250 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.991251:*:*:*:*:*:*:* Versions 0.991251 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999901:*:*:*:*:*:*:* Versions 0.999901 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999902:*:*:*:*:*:*:* Versions 0.999902 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999903:*:*:*:*:*:*:* Versions 0.999903 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999904:*:*:*:*:*:*:* Versions 0.999904 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999905:*:*:*:*:*:*:* Versions 0.999905 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999906:*:*:*:*:*:*:* Versions 0.999906 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999907:*:*:*:*:*:*:* Versions 0.999907 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999908:*:*:*:*:*:*:* Versions 0.999908 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999909:*:*:*:*:*:*:* Versions 0.999909 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999910:*:*:*:*:*:*:* Versions 0.999910 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999911:*:*:*:*:*:*:* Versions 0.999911 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999912:*:*:*:*:*:*:* Versions 0.999912 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999913:*:*:*:*:*:*:* Versions 0.999913 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999914:*:*:*:*:*:*:* Versions 0.999914 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999920:*:*:*:*:*:*:* Versions 0.999920 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999921:*:*:*:*:*:*:* Versions 0.999921 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999922:*:*:*:*:*:*:* Versions 0.999922 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999923:*:*:*:*:*:*:* Versions 0.999923 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999924:*:*:*:*:*:*:* Versions 0.999924 Vulnerable ·Mojolicious
- cpe:2.3:a:mojolicious:mojolicious:0.999925:*:*:*:*:*:*:* Versions 0.999925 Vulnerable ·Mojolicious
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2010-4803
- 2026-10-03 Alias added: GHSA-4q9r-c3w8-rm5f
References
More Mojolicious vulnerabilities
- TI-2024-38343 Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session… CVSS 3.1MEDIUM 5.3
- TI-2021-21869 The Mojolicious module before 9.11 for Perl has a bug in format detection that can… CVSS 3.1MEDIUM 4.3
- TI-2010-04525 Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment… CVSS 2.0HIGH 10.0
- TI-2009-04826 Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious… CVSS 2.0HIGH 10.0
- TI-2024-38342 Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the… CVSS 3.1HIGH 8.1
- TI-2011-01408 Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2010-4803 · CVE Program
- CVE-2010-4803 · NVD
- FIRST EPSS
- GHSA-4q9r-c3w8-rm5f · GitHub Advisory Database · CC BY 4.0
- CVE-2010-4803 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences