As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array
Dancer2 versions prior to 2.2.0 for Perl fail to strip carriage return (CR) and line feed (LF) characters from response header names in the headers_to_array function. This allows attackers to inject arbitrary headers into HTTP responses, potentially leading to cache poisoning, cross-site scripting (XSS), or other header manipulation attacks. The CPAN Security Group disclosed the vulnerability as CVE-2026-93711.
Why it matters: Perl developers using Dancer2 web framework versions before 2.2.0 are exposed to header injection attacks that could compromise application behavior and user security; immediate upgrade to 2.2.0 or later is required.
- Source published
- First seen by Cybersecurity Tracker