CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array
Dancer2 before 2.2.0 leaves CR and LF in response header names, enabling header injection.
40
Vulnerability1 · 1 read
CVE-2026-93711
Unauthenticated Header Splitting in Dancer2 Perl Before 2.2.0
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Dancer2 versions before 2.2.0 have a flaw where response header names containing CR and LF are not stripped during header parsing. This allows an attacker to inject custom headers and split the response, enabling unauthorized access to sensitive data. The vulnerability is triggered by an attacker controlling request-derived header data, which is written to the wire as raw header lines. An attacker gains unauthorized access and data exposure. The affected scope is limited to Dancer2 before 2.2.0.
What to do: Upgrade to Dancer2 2.2.0 or later. Validate header names before parsing response headers and reject non-standard names. Monitor servers for malformed headers and invalid keys. Do not rely on request-derived header names for security.
| Product | Affected |
|---|---|
| Dancer2 (Perl) | before 2.2.0 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response.
- Weakness
- CWE-113
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N