CVE-2026-93710
Received Received - Intake

Dancer2 Perl Framework Route Handling Flaw

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CPANSec

Description
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs. The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs. A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-93710
EUVD
EUVD-2026-84256

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perldancer dancer2 From 2.0.0 (inc) to 2.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-460 The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Dancer2 (CVE-2026-93710) allows a route to execute even when a before hook refuses it. It occurs when an exception handler halts the response after a before hook dies. The cleanup process triggered by halting clears the request state, letting the refused route run. This bypasses access controls silently.

Detection Guidance

Detecting this vulnerability requires checking for specific patterns in Dancer2 applications. Look for applications using on_hook_exception handlers that halt the response and before hooks that die instead of halting or forwarding. Review application logs for routes executing despite failed before hooks. Check for the presence of Dancer2 versions between 2.0.0 and 2.2.0.

Impact Analysis

The vulnerability can lead to access control bypasses where authentication or authorization checks fail silently. The route may still execute, causing unintended actions like database changes or sending emails. Exploitation requires specific conditions: an on_hook_exception handler that halts and a dying before hook.

Compliance Impact

This vulnerability could lead to compliance violations under GDPR or HIPAA by allowing unauthorized access to sensitive data. If a before hook enforces authentication or authorization checks but dies, the route may still execute due to improper cleanup, potentially processing or exposing protected data without proper safeguards.

Mitigation Strategies

Upgrade Dancer2 to version 2.2.0 or later to apply the patch. If upgrading is not possible, avoid halting in exception handlers and ensure before hooks use halt or forward instead of dying. Re-check authorization conditions in route bodies as a secondary validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93710. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart