CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks
Dancer2 before 2.2.0 can dispatch a route a dying hook refused when compile_hooks exception handling halts the response.
Stig Palmquist disclosed CVE-2026-93710 in the Perl Dancer2 web framework on oss-security. Versions from 2.0.0 before 2.2.0 can still dispatch a route that a dying hook intended to refuse when the exception handler halts the response inside compile_hooks. The report does not describe exploitation in the wild.
- Affects Dancer2 2.0.0 through releases before 2.2.0.
- A hook that dies to refuse a route can be ignored.
- Occurs when the exception handler halts the response in compile_hooks.
- No in-the-wild exploitation is reported.
- CVEs
- CVE-2026-93710
- Products
- Dancer2
- Organizations
- PerlDancer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93710 | Unauthenticated Route Refusal in Dancer2 Versions 2.0.0-2.1.9 | 7.5 | — |
From the original article
Posted by Stig Palmquist on Sep 21 ======================================================================== https://metacpan. org/dist/Dancer2 https://github. com/PerlDancer/Dancer2 Dancer2 versions from...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.