Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Four Dancer2 Perl framework flaws (CVE-2026-93709 to CVE-2026-93712) disclosed on oss-security, all fixed in version 2.2.0

1 source · 3 articlesFirst reported Updated ()2 · 1 read
What's new

This merge of the four source reports adds no substantive new facts beyond the previous story summary: the same four CVEs, affected version ranges, and affected components are confirmed, the reports do not conflict, and there is still no reported exploitation in the wild for any issue.

Merged summary · glm-5.3 · rewritten as coverage arrivesSummaries by Vani AI

Four oss-security disclosures by Stig Palmquist, posted 2026-09-22 between 01:10:25Z and 01:17:05Z, describe distinct flaws in the Perl web framework Dancer2, all remediated in 2.2.0: a layout served as a page via an AutoPage guard bypass, dispatch of a route…

Stig Palmquist posted four oss-security disclosures about the Perl web framework Dancer2 (MetaCPAN distribution, PerlDancer GitHub repository) between 2026-09-22T01:10:25Z and 2026-09-22T01:17:05Z. All four issues are fixed in Dancer2 2.2.0, but the affected version ranges differ. CVE-2026-93709 affects all versions before 2.2.0: an equivalent spelling of a layout's path misses the guard in the AutoPage handler, so the layout is served as a page. CVE-2026-93710 affects versions from 2.0.0 before 2.2.0: when the exception handler halts the response in compile_hooks, a route that a dying hook refused is nevertheless dispatched. CVE-2026-93711 affects all versions before 2.2.0: the headers_to_array function does not strip CR and LF characters from response header names, exposing applications to header injection through crafted header names. CVE-2026-93712 affects versions from 2.1.0 before 2.2.0: the File route handler serves files from outside the configured public_dir when a request uses relative path segments. The four reports do not conflict; they describe separate flaws in different components (AutoPage handler, compile_hooks, headers_to_array, and the File route handler). None of the disclosures report exploitation in the wild. Upgrading to Dancer2 2.2.0 addresses all four issues.

Key facts
  • All four disclosures were posted by Stig Palmquist on oss-security, with report timestamps from 2026-09-22T01:10:25Z through 2026-09-22T01:17:05Z.
  • All four flaws are remediated in Dancer2 version 2.2.0.
  • CVE-2026-93709: affects Dancer2 versions before 2.2.0; an equivalent spelling of a layout path misses the guard in the AutoPage handler, causing the layout to be served as a page.
  • CVE-2026-93710: affects Dancer2 versions from 2.0.0 before 2.2.0; a route a dying hook refused is still dispatched when the exception handler halts the response in compile_hooks.
  • CVE-2026-93711: affects Dancer2 versions before 2.2.0; headers_to_array does not strip CR and LF from response header names, leaving applications exposed to header injection via crafted header names.
  • CVE-2026-93712: affects Dancer2 versions from 2.1.0 before 2.2.0; the File route handler serves files from outside the configured public_dir when a request uses relative path segments.
  • No in-the-wild exploitation is reported for any of the four CVEs.
  • The disclosures reference the MetaCPAN distribution (https://metacpan.org/dist/Dancer2) and the PerlDancer GitHub repository (https://github.com/PerlDancer/Dancer2).
Analyze CVE-2026-93709 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-93712CVE-2026-93710CVE-2026-93711CVE-2026-93709
Vendors
PerlDancer
Products
Dancer2
Organizations
PerlDancer

Coverage

oldest first · one row per article · UTC
  1. · Sep 22, 2026 oss-securityFirst report

    CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler

    Dancer2 before 2.2.0 can serve a layout as a page when an alternate path spelling bypasses the AutoPage guard.

  2. · Sep 22, 2026 oss-security

    CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks

    Dancer2 before 2.2.0 can dispatch a route a dying hook refused when compile_hooks exception handling halts the response.

  3. · Sep 22, 2026 oss-security

    CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array

    Dancer2 before 2.2.0 leaves CR and LF in response header names, enabling header injection.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-93709
Path-Equivalence Bypass in Dancer2 AutoPage (pre-2.2.0) Leaks Layout Templates
5.3—
CVE-2026-93710
Unauthenticated Route Refusal in Dancer2 Versions 2.0.0-2.1.9
7.5—
CVE-2026-93711
Unauthenticated Header Splitting in Dancer2 Perl Before 2.2.0
6.5—
CVE-2026-93712
Unauthenticated RCE in Dancer2 2.1.0 before 2.2.0 for Perl
7.5—