CVE-2026-93710
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
22/09/2026
Last modified:
22/09/2026
Description
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks.<br />
<br />
A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs.<br />
<br />
The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs.<br />
<br />
A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH