CVE-2026-93711
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-113
Neutralización incorrecta de secuencias CRLF en cabeceras HTTP (División de respuesta HTTP)
Fecha de publicación:
22/09/2026
Última modificación:
22/09/2026
Descripción
*** Pendiente de traducción *** Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array.<br />
<br />
The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line.<br />
<br />
The application has to derive the header name from request data, not just the value.<br />
<br />
An attacker who controls that data adds their own headers and splits the response.
Impacto
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA