CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array

Dancer2 versions before 2.2.0 have a flaw where response header names containing CR and LF are not stripped during header parsing. This allows an attacker to inject custom headers and split the response, enabling unauthorized access to sensitive data. The vulnerability is triggered by an attacker controlling request-derived header data, which is written to the wire as raw header lines. An attacker gains unauthorized access and data exposure. The affected scope is limited to Dancer2 before 2.2.0.

Do: Upgrade to Dancer2 2.2.0 or later. Validate header names before parsing response headers and reject non-standard names. Monitor servers for malformed headers and invalid keys. Do not rely on request-derived header names for security.