CVE-2026-93711

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93711

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93711.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93711

Downstream

DEBIAN-CVE-2026-93711

Published

2026-09-22T00:52:11Z

Modified

2026-09-22T11:46:01Z

Summary

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array

Details

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array.

The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line.

The application has to derive the header name from request data, not just the value.

An attacker who controls that data adds their own headers and splits the response.

Database specific

{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-113"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93711.json"
}

References

Affected packages

Git / github.com/perldancer/dancer2

Affected ranges

Type

GIT

Repo

https://github.com/perldancer/dancer2

Events

Introduced

Fixed

9931faa20d48fbd017c500a88f9236a1276c0ea9

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.2.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.02

v0.03

v0.04

v0.06

v0.08

v0.09

v0.10

v0.11

v0.12

v0.13

v0.140000

v0.140001

v0.140900_01

v0.141000

v0.142000

v0.143000

v0.149000_01

v0.149000_02

v0.150000

v0.151000

v0.152000

v0.153000

v0.153001

v0.153002

v0.154000

v0.155000

v0.155001

v0.155002

v0.155003

v0.155004

v0.156000

v0.156001

v0.157000

v0.157001

v0.158000

v0.159000

v0.159001

v0.159002

v0.159003

v0.160000

v0.160002

v0.160003

v0.161000

v0.161000_01

v0.162000

v0.162000_01

v0.163000

v0.164000

v0.165000

v0.166000

v0.166001

v0.166001_01

v0.166001_02

v0.166001_03

v0.166001_04

v0.200000

v0.200001

v0.200002

v0.200003

v0.200004

v0.201000

v0.202000

v0.203000

v0.203001

v0.204000

v0.204001

v0.204002

v0.204003

v0.204004

v0.205000

v0.205001

v0.205002

v0.206000

v0.206000_02

v0.207000

v0.208000

v0.208001

v0.208002

v0.300000

v0.300001

v0.300002

v0.300003

v0.300004

v0.300005

v0.301000

v0.301001

v0.301002

v0.301003

v0.301004

v0.400001

v1.*

v1.0.0

v1.1.0

v1.1.1

v1.1.2

v1.9999_01

v1.9999_02

v2.*

v2.0.0

v2.0.1

v2.0000_01

v2.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93711.json"