Homepage

CVE-2024-58134 Affecting libmojolicious-perl package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.55% (44th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ECHOLATEST-LIBMOJOLICIOUSPERL-17978447
  • published15 Jul 2026
  • disclosed3 May 2025
Report a new vulnerability Found a mistake?

Introduced: 3 May 2025

CVE-2024-58134  (opens in a new tab)

How to fix?

There is no fixed version for Echo:latest libmojolicious-perl.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libmojolicious-perl package and not the libmojolicious-perl package as distributed by Echo. See How to fix? for Echo:latest relevant fixed versions and status.

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.

These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

References