CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array
Dancer2 before 2.2.0 leaves CR and LF in response header names, enabling header injection.
1 stories, newest first · one card per story
Dancer2 before 2.2.0 leaves CR and LF in response header names, enabling header injection.
Today 1.6K readers · 2.5K views · 779 reads · all time 189K views