CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response.

• CWE-113

• https://github.com/PerlDancer/Dancer2/commit/ff89ac12af7b8899812a79e9924dfea7a5d9833b.patch
• https://github.com/PerlDancer/Dancer2/issues/1822
• https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes
• https://www.openwall.com/lists/oss-security/2026/09/22/3

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9369A security flaw has been discovered in NousResearch hermes-a…5.3
• CVE-2026-93690uri-js through 4.4.1 contains a denial of service vulnerabil…7.5
• CVE-2026-9370A weakness has been identified in ulisesbocchio jasypt-sprin…3.7
• CVE-2026-93709Dancer2 versions before 2.2.0 for Perl serve a layout as a p…5.3
• CVE-2026-9371A security vulnerability has been detected in ItzCrazyKns Va…5.6
• CVE-2026-93710Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a…7.5
• CVE-2026-93712Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve file…7.5
• CVE-2026-9372A flaw has been found in ItzCrazyKns Vane up to 1.12.1. This…7.3
• CVE-2026-9373A vulnerability has been found in JeecgBoot 3.9.1. This issu…6.3
• CVE-2026-93736Mealie before 3.21.0 fails to validate user ownership in the…4.3
• CVE-2026-93737Azkaban through 4.0.0 omits project permission checks in the…6.5
• CVE-2026-93738A vulnerability was found in Totolink A3002MU Hh-B20211125.1…9.9