Improper Input Validation in Dancer2 for Perl by Perl Dancer

CVE-2026-93711

What is CVE-2026-93711?

The Dancer2 framework for Perl prior to version 2.2.0 is affected by a vulnerability that fails to properly sanitize response header names, allowing an attacker to inject carriage return (CR) and line feed (LF) characters. This flaw can lead to header injection attacks, whereby an attacker who controls the input data can create malformed headers that disrupt server responses. Specifically, the server improperly processes these header names, causing unintended behavior like splitting of response lines. It is critical for applications to validate header names based on request data to prevent such exploits.

References