libmojo-jwt-perl - Debian Package Tracker

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-9537: Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes. A caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.

Created: 2026-07-17 Last update: 2026-09-01 22:00

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-9537: Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes. A caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.

Created: 2026-07-17 Last update: 2026-08-08 18:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.02-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 080a5d3b24f86d7f5bf2627ffca86633a324f4b0
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 01:35:19 2026 +0100

    update changelog
    
    Gbp-Dch: Ignore

commit eb8d4af4ec9e56bf36a83100f1359c54de05b641
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 01:35:19 2026 +0100

    Convert debian/watch to version 5.

Created: 2026-11-08 Last update: 2026-11-08 02:33

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-9537: (needs triaging) Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of matching leading bytes. A caller that decodes attacker supplied tokens leaks the expected signature through this timing variation, which can be aggregated over many requests to recover the signature and forge a token.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-07-17 Last update: 2026-09-01 22:00