CVE-2026-93710
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
22/09/2026
Última modificación:
22/09/2026
Descripción
*** Pendiente de traducción *** Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks.<br />
<br />
A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs.<br />
<br />
The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs.<br />
<br />
A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.
Impacto
Puntuación base 3.x
7.50
Gravedad 3.x
ALTA