TI-2021-21869 Aliases CVE-2021-47208 GHSA-fv9f-467f-xm3f

The Mojolicious module before 9.11 for Perl has a bug in format detection that can…

MEDIUM 53CWE-400Published 2024-04-07 · Updated 2025-03-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-400.

Summary

The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00554 46th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mojolicious:mojolicious::::::perl::*	before 9.11	Vulnerable	Mojolicious

cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:perl:*:* Versions before 9.11 Vulnerable ·Mojolicious

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-47208
2026-10-03 Alias added: GHSA-fv9f-467f-xm3f

References

Exploit 1

https://github.com/mojolicious/mojo/issues/1736

Patch 1

https://github.com/mojolicious/mojo/commit/a0c4576ffb11c235088550de9ba7ac4196e1953c

TI-2024-38343 Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session… CVSS 3.1MEDIUM 5.3
TI-2010-04526 Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has… CVSS 2.0HIGH 10.0
TI-2010-04525 Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment… CVSS 2.0HIGH 10.0
TI-2009-04826 Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious… CVSS 2.0HIGH 10.0
TI-2024-38342 Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the… CVSS 3.1HIGH 8.1
TI-2011-01408 Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote… CVSS 2.0MEDIUM 5.0

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences