CVE-2026-93711
UnknownSummary
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name, allowing injection of additional headers and response splitting. The application must derive the header name from request data.
Risk Assessment
The risk includes the possibility of HTTP response manipulation, potentially leading to response splitting, cache poisoning, or other integrity violations.
Recommendation
Update Dancer2 to version 2.2.0 or later and validate/sanitize header names derived from request data.
Other vulnerabilities in Dancer2
See all- CVE-2026-93712Unknown
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, allowing access to files outside the public directory. The handler is off by default, but an application is affected once it names File in route_handlers and sets static_handler to 0.
- CVE-2026-93710Unknown
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A handler that halts does not stop cleanup, leading to the refused route being executed. This can allow bypassing checks in a before hook.
- CVE-2026-93709Unknown
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or different capitalisation on a case-insensitive filesystem misses the guard.
- CVE-2026-13577High
Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. It silently falls back to a built-in rand-derived session id, which has low entropy and is easily guessed. Predictable session ids could allow an attacker to gain access to systems.
Original NVD description (English source)
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response.