Story · 1 source · 4 articlesfirst Sep 22, 01:10 UTCupdated Sep 22, 01:17 UTC (5d ago)

Four Dancer2 Perl framework flaws (CVE-2026-93709 to CVE-2026-93712) disclosed on oss-security, all fixed in version 2.2.0

mediumVulnerabilityimportance 44CVE-2026-93712 CVE-2026-93710 CVE-2026-93711 CVE-2026-93709

What's new: This merge of the four source reports adds no substantive new facts beyond the previous story summary: the same four CVEs, affected version ranges, and affected components are confirmed, the reports do not conflict, and there is still no reported exploitation in the wild for any issue.

Merged summary · glm-5.3 · rewritten as coverage arrives

Four oss-security disclosures by Stig Palmquist, posted 2026-09-22 between 01:10:25Z and 01:17:05Z, describe distinct flaws in the Perl web framework Dancer2, all remediated in 2.2.0: a layout served as a page via an AutoPage guard bypass, dispatch of a route…

Stig Palmquist posted four oss-security disclosures about the Perl web framework Dancer2 (MetaCPAN distribution, PerlDancer GitHub repository) between 2026-09-22T01:10:25Z and 2026-09-22T01:17:05Z. All four issues are fixed in Dancer2 2.2.0, but the affected version ranges differ. CVE-2026-93709 affects all versions before 2.2.0: an equivalent spelling of a layout's path misses the guard in the AutoPage handler, so the layout is served as a page. CVE-2026-93710 affects versions from 2.0.0 before 2.2.0: when the exception handler halts the response in compile_hooks, a route that a dying hook refused is nevertheless dispatched. CVE-2026-93711 affects all versions before 2.2.0: the headers_to_array function does not strip CR and LF characters from response header names, exposing applications to header injection through crafted header names. CVE-2026-93712 affects versions from 2.1.0 before 2.2.0: the File route handler serves files from outside the configured public_dir when a request uses relative path segments. The four reports do not conflict; they describe separate flaws in different components (AutoPage handler, compile_hooks, headers_to_array, and the File route handler). None of the disclosures report exploitation in the wild. Upgrading to Dancer2 2.2.0 addresses all four issues.

All four disclosures were posted by Stig Palmquist on oss-security, with report timestamps from 2026-09-22T01:10:25Z through 2026-09-22T01:17:05Z.
All four flaws are remediated in Dancer2 version 2.2.0.
CVE-2026-93709: affects Dancer2 versions before 2.2.0; an equivalent spelling of a layout path misses the guard in the AutoPage handler, causing the layout to be served as a page.
CVE-2026-93710: affects Dancer2 versions from 2.0.0 before 2.2.0; a route a dying hook refused is still dispatched when the exception handler halts the response in compile_hooks.
CVE-2026-93711: affects Dancer2 versions before 2.2.0; headers_to_array does not strip CR and LF from response header names, leaving applications exposed to header injection via crafted header names.
CVE-2026-93712: affects Dancer2 versions from 2.1.0 before 2.2.0; the File route handler serves files from outside the configured public_dir when a request uses relative path segments.
No in-the-wild exploitation is reported for any of the four CVEs.
The disclosures reference the MetaCPAN distribution (https://metacpan.org/dist/Dancer2) and the PerlDancer GitHub repository (https://github.com/PerlDancer/Dancer2).

VendorsPerlDancer

ProductsDancer2

OrganizationsPerlDancer

Coverage timelineoldest first · each row is one article

Sep 22, 01:10 UTC · 5d ago
oss-security· 38
CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler
Dancer2 before 2.2.0 can serve a layout as a page when an alternate path spelling bypasses the AutoPage guard.
Sep 22, 01:12 UTC · 5d ago
oss-security· 42
CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks
Dancer2 before 2.2.0 can dispatch a route a dying hook refused when compile_hooks exception handling halts the response.
Sep 22, 01:14 UTC · 5d ago
oss-security· 40
CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array

Vulnerabilities in this storyAll →

CVE-2026-937095.3—
Path-Equivalence Bypass in Dancer2 AutoPage (pre-2.2.0) Leaks Layout Templates
published 5d ago· PerlDancer (Dancer2 project) Dancer2
CVE-2026-937107.5—
Unauthenticated Route Refusal in Dancer2 Versions 2.0.0-2.1.9
published 5d ago· Dancer2
CVE-2026-93711

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2026-93709	Path-Equivalence Bypass in Dancer2 AutoPage (pre-2.2.0) Leaks Layout Templates Dancer2, a Perl web framework, mishandles path equivalence in its AutoPage handler in versions before 2.2.0, allowing a request whose path merely re-spells the layouts directory (via a doubled slash, a dot segment, a percent-encoded slash, or different capitalisation on case-insensitive filesystems) to slip past the guard, after which the canonicalising lookup serves a layout file as a regular page. The flaw is CWE-41 (improper resolution of path equivalence) and only affects applications that enable the auto_page option, which is off by default. The attacker gains read access to the contents of one of the application's other layouts — a limited information disclosure, since the layout wrapping public pages is already visible in rendered output. No CVSS score has been assigned yet, no public proof of concept exists, and the issue is not in the CISA Known Exploited Vulnerabilities catalog, with no evidence of in-the-wild exploitation. Do: Upgrade Dancer2 to 2.2.0 or later, where the guard correctly handles equivalent path spellings. If upgrading is not immediately possible, disable auto_page or reject/normalise request paths containing doubled slashes, dot segments, or percent-encoded slashes (and be mindful of case-insensitive filesystems) before they reach the handler. Review access logs for requests matching layout directory paths spelled with these variants, which would indicate probing for this issue.	5.3	—	PerlDancer (Dancer2 project) Dancer2 before 2.2.0	nicheunknown; plausibly hundreds to a few thousand apps, likely under 10,000	5d ago
CVE-2026-93710	Unauthenticated Route Refusal in Dancer2 Versions 2.0.0-2.1.9 Dancer2 versions prior to 2.2.0 contain a flaw in Perl dispatch where a dying hook can refuse a route. When the exception handler halts the response, the cleanup process fails to stop the request, response, and session, allowing a refused route to execute. Attackers can exploit this flaw to gain unauthorized access or execute commands on affected systems. The vulnerability is primarily present in Dancer2 versions from 2.0.0 up to 2.1.9, and there are no known public exploits. Do: Upgrade Dancer2 versions to 2.2.0 or later to mitigate the vulnerability. Apply mitigations such as strict exception handling and verification of the response halting mechanism. Monitor deployment for known versions and update accordingly.	7.5	—	Dancer2 2.0.0 to 2.1.9	niche	5d ago
CVE-2026-93711	Unauthenticated Header Splitting in Dancer2 Perl Before 2.2.0 Dancer2 versions before 2.2.0 have a flaw where response header names containing CR and LF are not stripped during header parsing. This allows an attacker to inject custom headers and split the response, enabling unauthorized access to sensitive data. The vulnerability is triggered by an attacker controlling request-derived header data, which is written to the wire as raw header lines. An attacker gains unauthorized access and data exposure. The affected scope is limited to Dancer2 before 2.2.0. Do: Upgrade to Dancer2 2.2.0 or later. Validate header names before parsing response headers and reject non-standard names. Monitor servers for malformed headers and invalid keys. Do not rely on request-derived header names for security.	6.5	—	Dancer2 (Perl) before 2.2.0	niche	5d ago
CVE-2026-93712	Unauthenticated RCE in Dancer2 2.1.0 before 2.2.0 for Perl Dancer2 versions from 2.1.0 before 2.2.0 contain a vulnerability in the File route handler that allows unauthenticated access to files outside public_dir via relative path segments. An attacker can use requests like /../outside.txt or percent-encoded dots to reach arbitrary files, including application config.yml. The flaw is enabled when the File route handler is named and static_handler is set to 0, and it can serve any file the worker process can read without authentication. Do: Upgrade to Dancer2 2.2.0 or later. Disable the File route handler or set static_handler to 0 to prevent serving files outside public_dir. Verify that no attacker-controlled path or request can reach config.yml or other files outside public_dir.	7.5	—	Dancer2 (Perl) 2.1.0 before 2.2.0	niche	5d ago