CVE-2026-93711
Received Received - Intake

HTTP Header Injection in Dancer2 Perl Framework

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CPANSec

Description
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-93711
EUVD
EUVD-2026-84257

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perldancer dancer2 to 2.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dancer2 versions before 2.2.0 for Perl do not remove CR and LF characters from response header names. This allows attackers to inject malicious headers by including CRLF sequences in header names, potentially leading to response splitting attacks where the attacker controls part of the response.

Detection Guidance

To detect this vulnerability, inspect HTTP response headers for CR and LF characters in header names. Use tools like curl to fetch responses and check for unexpected header splitting. Example: curl -I http://target.example.com. Monitor for headers containing %0d%0a (URL-encoded CR LF) or raw CRLF sequences.

Impact Analysis

An attacker could manipulate header names to inject additional headers or split responses, leading to unauthorized data exposure, session hijacking, or cache poisoning. This requires the attacker to control the header name derivation, typically through user input.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Upgrade Dancer2 to version 2.2.0 or later. If upgrading is not possible, apply the patch from the GitHub commit ff89ac12. Ensure all third-party dependencies are updated. Review custom header handling code to confirm proper sanitization of header names.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart