The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line.
The application has to derive the header name from request data, not just the value.
An attacker who controls that data adds their own headers and splits the response.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Dancer2 2.2.0 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 22 Sep 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response. | |
| Title | Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array | |
| Weaknesses | CWE-113 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-09-22T00:52:11.643Z
Reserved: 2026-09-18T15:06:50.792Z
Link: CVE-2026-93711
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-22T01:16:55.847
Modified: 2026-09-22T01:16:55.847
Link: CVE-2026-93711
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')