CVE-2026-93711: fallo de gravedad media en Dancer2
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.4%
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array.
The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line.
The application has to derive the header name from request data, not just the value.
An attacker who controls that data adds their own headers and splits the response.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Productos afectados
Dancer2CVEs relacionadas — Dancer2
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-93710HIGHDancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooksEPSS 0.6%CVE-2026-13577HIGHDancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailableEPSS 0.6%CVE-2026-93712HIGHDancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handlerEPSS 0.5%CVE-2026-93709MEDIUMDancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handlerEPSS 0.5%