Unauthenticated Header Splitting in Dancer2 Perl Before 2.2.0
CVSS 3.1
6.5medium
EPSS
—
Published
()
Modified
AI analysis
Dancer2 versions before 2.2.0 have a flaw where response header names containing CR and LF are not stripped during header parsing. This allows an attacker to inject custom headers and split the response, enabling unauthorized access to sensitive data. The vulnerability is triggered by an attacker controlling request-derived header data, which is written to the wire as raw header lines. An attacker gains unauthorized access and data exposure. The affected scope is limited to Dancer2 before 2.2.0.
What to do: Upgrade to Dancer2 2.2.0 or later. Validate header names before parsing response headers and reject non-standard names. Monitor servers for malformed headers and invalid keys. Do not rely on request-derived header names for security.
Affected
Dancer2 (Perl)
before 2.2.0
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response.
Dancer2 before 2.2.0 leaves CR and LF in response header names, enabling header injection.
oss-security reports CVE-2026-93711 in Dancer2 for Perl, affecting versions before 2.2.0. The headers_to_array function does not strip carriage return and line feed characters from response header names. That leaves applications exposed to header-injection through crafted header names. Stig Palmquist disclosed the issue; the post does not report active exploitation.