CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array
Dancer2 before 2.2.0 leaves CR and LF in response header names, enabling header injection.
oss-security reports CVE-2026-93711 in Dancer2 for Perl, affecting versions before 2.2.0. The headers_to_array function does not strip carriage return and line feed characters from response header names. That leaves applications exposed to header-injection through crafted header names. Stig Palmquist disclosed the issue; the post does not report active exploitation.
- CVE-2026-93711 affects Dancer2 versions before 2.2.0.
- headers_to_array does not strip CR and LF from header names.
- Stig Palmquist posted the oss-security disclosure.
- No in-the-wild exploitation is stated.
- CVEs
- CVE-2026-93711
- Vendors
- PerlDancer
- Products
- Dancer2
- Organizations
- PerlDancer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93711 | Unauthenticated Header Splitting in Dancer2 Perl Before 2.2.0 | 6.5 | — |
From the original article
Posted by Stig Palmquist on Sep 21 ======================================================================== https://metacpan. org/dist/Dancer2 https://github. com/PerlDancer/Dancer2 Dancer2 versions before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.