CVE-2026-93711: Dancer2 response header injection via unsanitized header names

CVE-2026-93711 · Severity: medium · CVSS 6.5 · Published 2026-09-22

Dancer2, a web framework for Perl, fails to sanitize carriage return and line feed characters in HTTP response header names, allowing an attacker to inject additional response headers or split HTTP responses. When an application constructs header names from user-controlled data, an attacker can inject CRLF bytes to add malicious headers, potentially leading to cache poisoning, session fixation, or XSS attacks depending on the injected header.

Technologies: Perl Dancer Dancer2. Vendors: Perl Dancer.

Quick answers

Is CVE-2026-93711 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-93711 being exploited in the wild.
How severe is CVE-2026-93711?
Medium severity, with a CVSS score of 6.5, published 22 September 2026.
Which products and versions are affected?
Perl Dancer Dancer2 before 2.2.0.
Is there a fix for CVE-2026-93711?
A patch was published on 2026-08-05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93711 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-93711?
Check whether you run Perl Dancer Dancer2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The headers_to_array function in Dancer2::Core::Response removes CR and LF characters from header values but not from header names before passing them to the PSGI server. An attacker controlling header name data can inject CRLF bytes to split the response; whether the injected headers reach the wire depends on whether the PSGI server validates header names. The fix sanitizes both header names and values with the same character stripping logic, and also corrects content re-encoding to judge each assignment on its merits rather than using a stale encoding flag.

Affected products

  • Perl Dancer Dancer2 before 2.2.0

Timeline

  • 2026-09-22: disclosed
  • 2026-08-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.