The vulnerability arises because Dancer2's response header handling fails to strip carriage return and line feed characters from header names. Because the server transmits header names unchanged, an attacker who can influence request data can inject CRLF sequences into a header name, causing the server to write additional header lines. This allows the attacker to split the HTTP response, injecting arbitrary content or headers into the response stream, potentially facilitating cross‑site scripting, session hijacking, or other injection attacks.

The issue affects the Perl Dancer2 web application framework. Versions prior to 2.2.0 are vulnerable; the patch is in Dancer2 2.2.0 and later. The vulnerability applies to installations that allow user‑controlled response header names, such as custom extensions or middleware that use request data to build response headers.

The CVSS score is 6.5, the EPSS score is < 1%, and it is not listed in the KEV catalog. The vulnerability can be exploited remotely with minimal effort on any site using a vulnerable Dancer2 version and allowing header name manipulation. An attacker does not need elevated privileges and can execute the attack via crafted HTTP requests that set header names containing CRLF. No patch aside from an upgrade is currently available, so the risk remains high until remedied.