CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks

Dancer2 versions prior to 2.2.0 contain a flaw in Perl dispatch where a dying hook can refuse a route. When the exception handler halts the response, the cleanup process fails to stop the request, response, and session, allowing a refused route to execute. Attackers can exploit this flaw to gain unauthorized access or execute commands on affected systems. The vulnerability is primarily present in Dancer2 versions from 2.0.0 up to 2.1.9, and there are no known public exploits.

Do: Upgrade Dancer2 versions to 2.2.0 or later to mitigate the vulnerability. Apply mitigations such as strict exception handling and verification of the response halting mechanism. Monitor deployment for known versions and update accordingly.