Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-195
Advisory Release Date: 2026-10-12 09:00 Pacific
Advisory Updated Date: 2026-10-20 15:48 Pacific
Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-15747:
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.
_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.
An attacker able to query it can recover the token and pass csrf_protect validation.
CVE-2026-14803:
Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.
The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.
This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected.
Any caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.
Affected Packages:
perl-Mojolicious
Issue Correction:
Run dnf update perl-Mojolicious or dnf update --advisory ALAS2027-2026-195 to update your system.
noarch:
perl-Test-Mojo-9.48-2.amzn2027.0.1.noarch
perl-Mojolicious-9.48-2.amzn2027.0.1.noarch
src:
perl-Mojolicious-9.48-2.amzn2027.0.1.src