Executive brief
Dancer2, a web framework for Perl, fails to sanitize carriage return and line feed characters in HTTP response header names, allowing an attacker to inject additional response headers or split HTTP responses. When an application constructs header names from user-controlled data, an attacker can inject CRLF bytes to add malicious headers, potentially leading to cache poisoning, session fixation, or XSS attacks depending on the injected header.
Technical details
The headers_to_array function in Dancer2::Core::Response removes CR and LF characters from header values but not from header names before passing them to the PSGI server. An attacker controlling header name data can inject CRLF bytes to split the response; whether the injected headers reach the wire depends on whether the PSGI server validates header names. The fix sanitizes both header names and values with the same character stripping logic, and also corrects content re-encoding to judge each assignment on its merits rather than using a stale encoding flag.
Affected products
- Perl Dancer Dancer2 before 2.2.0
Timeline
- 2026-09-22: disclosed
- 2026-08-05: patched