Dancer2 (Product): news timeline & CVEs

CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

Dancer2 before 2.2.0 can serve files outside public_dir via relative path segments.

oss-security carries CVE-2026-93712, affecting the Perl web framework Dancer2 from version 2.1.0 before 2.2.0. The File route handler can serve files from outside the configured public_dir when a request uses relative path segments. Stig Palmquist posted the notice, pointing to the MetaCPAN distribution and the PerlDancer GitHub repository. The announcement does not say the flaw is being exploited.

oss-securitySep 22, 01:17 UTC · 5d agoVulnerability 4 sources CVE-2026-93712

CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array

Dancer2 before 2.2.0 leaves CR and LF in response header names, enabling header injection.

oss-security reports CVE-2026-93711 in Dancer2 for Perl, affecting versions before 2.2.0. The headers_to_array function does not strip carriage return and line feed characters from response header names. That leaves applications exposed to header-injection through crafted header names. Stig Palmquist disclosed the issue; the post does not report active exploitation.

oss-securitySep 22, 01:14 UTC · 5d agoVulnerability 4 sources CVE-2026-93711

CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks

Dancer2 before 2.2.0 can dispatch a route a dying hook refused when compile_hooks exception handling halts the response.

Stig Palmquist disclosed CVE-2026-93710 in the Perl Dancer2 web framework on oss-security. Versions from 2.0.0 before 2.2.0 can still dispatch a route that a dying hook intended to refuse when the exception handler halts the response inside compile_hooks. The report does not describe exploitation in the wild.

oss-securitySep 22, 01:12 UTC · 5d agoVulnerability 4 sources CVE-2026-937101

CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler

Dancer2 before 2.2.0 can serve a layout as a page when an alternate path spelling bypasses the AutoPage guard.

CVE-2026-93709 affects Perl Dancer2 versions before 2.2.0. An equivalent spelling of a layout path can miss the guard in the AutoPage handler, causing the framework to serve that layout as a page. The oss-security post, also from Stig Palmquist, does not report observed exploitation.

oss-securitySep 22, 01:10 UTC · 5d agoVulnerability 4 sources CVE-2026-937091

Dancer2

Timeline4 articles

Related CVEsby mentions

Appears with

CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array

CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks

CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler