CVE-2026-93710
UnknownSummary
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A handler that halts does not stop cleanup, leading to the refused route being executed. This can allow bypassing checks in a before hook.
Risk Assessment
The risk is the possibility of bypassing security checks implemented in hooks, potentially leading to unauthorized access or unintended operations.
Recommendation
Update Dancer2 to version 2.2.0 or later and review hook logic to ensure that halting the response actually stops processing.
Other vulnerabilities in Dancer2
See all- CVE-2026-93712Unknown
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, allowing access to files outside the public directory. The handler is off by default, but an application is affected once it names File in route_handlers and sets static_handler to 0.
- CVE-2026-93711Unknown
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name, allowing injection of additional headers and response splitting. The application must derive the header name from request data.
- CVE-2026-93709Unknown
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or different capitalisation on a case-insensitive filesystem misses the guard.
- CVE-2026-13577High
Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. It silently falls back to a built-in rand-derived session id, which has low entropy and is easily guessed. Predictable session ids could allow an attacker to gain access to systems.
Original NVD description (English source)
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs. The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs. A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.