CVE-2026-93712: Improper Limitation of a Pathname to a Restricted Directory

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

p5-Dancer2 -- Multiple vulnerabilities

Dancer project reports: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app. hookexception, then calls cleanup unless the failing hook is the exception handler. ...

Linux Distros Unpatched Vulnerability : CVE-2026-93709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler...

Linux Distros Unpatched Vulnerability : CVE-2026-93711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value...

Linux Distros Unpatched Vulnerability : CVE-2026-93710

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A ho...

CVE-2026-93711: Improper Neutralization of CRLF Sequences in HTTP Headers

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

Linux Distros Unpatched Vulnerability : CVE-2026-93712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the...

[SECURITY] Fedora 43 Update: perl-Dancer2-1.1.2-4.fc43

Dancer2 is the new generation of Dancer, the lightweight web-framework for Perl. It is a complete rewrite based on Moo and is meant to be easy and fun...

[SECURITY] Fedora 44 Update: perl-Dancer2-2.0.1-4.fc44

Dancer2 is the new generation of Dancer, the lightweight web-framework for Perl. It is a complete rewrite based on Moo and is meant to be easy and fun...

[SECURITY] Fedora 45 Update: perl-Dancer2-2.1.0-3.fc45

Dancer2 is the new generation of Dancer, the lightweight web-framework for Perl. It is a complete rewrite based on Moo and is meant to be easy and fun...

Fedora 43 : perl-Dancer2 (2026-d0bededb87)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d0bededb87 advisory. Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there...

Fedora 45 : perl-Dancer2 (2026-28c5da9193)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-28c5da9193 advisory. Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there...

Fedora 44 : perl-Dancer2 (2026-d13a2593b1)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d13a2593b1 advisory. Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there...

perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 on GA media (moderate)

perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11564-1 Rating: moderate Cross-References: CVE-2026-15689 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues...

PT-2026-80612

These are all security issues fixed in the perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11564-1 perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 on GA media

These are all security issues fixed in the perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

EUVD-2026-59758

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689 Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...