CVE-2026-93711 Details
Description
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response.
A vulnerability exists in Dancer2 versions prior to 2.2.0 for Perl, where the framework fails to remove carriage return (CR) and line feed (LF) characters from response header names. While the header values are sanitized to remove these characters, the names are not, allowing an attacker to inject additional headers and perform HTTP response splitting. This issue arises because the application derives header names from request data, which can be manipulated to include CRLF sequences, potentially leading to the injection of malicious headers or the disruption of the response structure.
Upgrade to Dancer2 version 2.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/PerlDancer/Dancer2/commit/ff89ac12af7b8899812a79e9924dfea7a5d9833b.patch | CPANSec | Source CodeVendor |
| https://github.com/PerlDancer/Dancer2/issues/1822 | CPANSec | Issue TrackingTechnical DescriptionVendor |
| https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes | CPANSec | Source CodeVendor |
| http://www.openwall.com/lists/oss-security/2026/09/22/3 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Dancer2 | < 2.2.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | CVE Modified | CVE |
| Sep 22, 2026 | New CVE Received | CPANSec |