CVE-2026-93711
Severity CVSS v4.0:
Pending analysis
Type:
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Publication date:
22/09/2026
Last modified:
22/09/2026
Description
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array.<br />
<br />
The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line.<br />
<br />
The application has to derive the header name from request data, not just the value.<br />
<br />
An attacker who controls that data adds their own headers and splits the response.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM