CVE-2026-93710 Details
Description
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs. The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs. A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.
An access control bypass vulnerability has been identified in Dancer2, a Perl web framework, specifically in versions 2.0.0 prior to 2.2.0. The issue arises when a 'before' hook, typically used for authentication and authorization checks, dies and an 'on_hook_exception' handler is registered to set a response and halt further processing. In this scenario, the route that the 'before' hook refused is still executed, leading to unintended side effects such as charges or emails being sent. This vulnerability is particularly concerning because it can be exploited by causing a hook to throw an exception, bypassing critical access controls without any indication of failure.
Upgrade to Dancer2 version 2.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/PerlDancer/Dancer2/commit/8fd31a32798f9aa25e4fccbd6c7cb9dd3a0c1029.patch | CPANSec | Source CodeVendor |
| https://github.com/PerlDancer/Dancer2/security/advisories/GHSA-v527-r4px-7vx7 | CPANSec | AdvisoryRemedyVendor |
| https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes | CPANSec | Source CodeVendor |
| http://www.openwall.com/lists/oss-security/2026/09/22/2 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-460 | Improper Cleanup on Thrown Exception | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Dancer2 | >= 2.0.0, < 2.2.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | CVE Modified | CVE |
| Sep 22, 2026 | New CVE Received | CPANSec |