Post-processing Hook Vulnerability in Dancer2 by Perl

CVE-2026-93710

What is CVE-2026-93710?

A vulnerability exists in Dancer2 for Perl that allows routes to be executed even when they have been declined by the exception handler. When an exception triggers a hook that is designed to halt further processing, it fails to prevent cleanup from discarding the current request, response, and session data. This leads to unwanted route execution, potentially compromising application integrity. Specifically, the fault occurs in the processing of hooks, where a refusal by the called handler does not properly enforce halting, allowing code execution beyond the expected control flow.

References