In Dancer2 versions 2.0.0 through 2.1.x, a dying hook that throws an exception triggers the core.app.hook_exception handler, which begins a cleanup routine that discards the request, response and session objects even when the exception handler itself halts the response; as a result, the dispatcher still runs the route body through its refusal machinery, allowing the route code to execute on a request that should have been aborted, potentially leading to unintended code execution within routes and incorrect responses.

All installations of the Dancer2 Perl web framework from version 2.0.0 up to (but not including) 2.2.0 are affected; release 2.2.0 and later address the issue and are not impacted.

The CVSS score of 7.5 classifies the vulnerability as high severity; the EPSS score of < 1% indicates a very low probability of automated exploitation, and it is not listed in the CISA KEV catalog; the likely attack vector, inferred from the fact that the flaw activates when a dying hook halts the response, is triggering a hook failure through crafted input or a compromised plugin, which could cause the route to run unexpectedly.