PerlDancer Dancer2 up to 2.1.x Hook Execution core/app.pm compile_hooks information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in PerlDancer Dancer2 up to 2.1.x. This affects the function compile_hooks of the file core/app.pm of the component Hook Execution. Performing a manipulation results in information disclosure. This vulnerability was named CVE-2026-93710. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in PerlDancer Dancer2 up to 2.1.x. This affects the function compile_hooks of the file core/app.pm of the component Hook Execution. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs. The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs. A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-93710 since 09/18/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 2.2.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• PerlDancer

Name

• Dancer2

Version

• 2.0
• 2.1

Website

• Product: https://github.com/PerlDancer/Dancer2/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion