EUVD-2026-84256
GHSA-qp5m-r6hx-rjhj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated request bypasses a dying-before-hook refusal so the route's writes land (integrity); caller only gets the refusal (C:N) and there is no availability loss, contradicting the vendor's A:H.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
6DescriptionCVE.org
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks.
A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs.
The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs.
A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.
AnalysisAI
Security-control bypass in the Dancer2 Perl web framework (2.0.0 through 2.1.x) lets a refused route execute anyway: when an application enforces an authorization or security check by having a 'before' hook die and also registers an on_hook_exception handler that halts the response, the post-exception cleanup still runs and destroys the request, response and session the dispatcher needs, so the route body the hook meant to refuse runs and its writes land. The flaw requires that specific non-default application design - apps that do not refuse via dying hooks, or whose exception handler does not halt the response, are not affected - and, when the pattern is present, a single unauthenticated remote request is enough to trigger it (AV:N/AC:L/PR:N/UI:N), giving a high integrity impact on denial-protected state changes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a Dancer2 application on 2.0.0 through 2.1.x that (1) enforces a security or authorization check by having a 'before' hook die to refuse the request, AND (2) registers an on_hook_exception handler that halts the response (by calling the response's halt method or setting is_halted). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a security-control-bypass in the Dancer2 Perl web framework (2.0.0 before 2.2.0, CWE-460 improper cleanup on thrown exception). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Dancer2 2.2.0, the vendor-released patch version, which makes compile_hooks idempotent via a per-hook _compiled_hooks registry (keyed by Scalar::Util::refaddr with a retained reference) and adds '|| $is_halted' to the cleanup guard so a halted response is never destroyed (see the advisory at https://github.com/PerlDancer/Dancer2/security/advisories/GHSA-v527-r4px-7vx7 and the commit at https://github.com/PerlDancer/Dancer2/commit/8fd31a32798f9aa25e4fccbd6c7cb9dd3a0c1029.patch, plus the release notes at https://metacpan.org/release/CROMEDOME/Dancer2-2.2.0/changes). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application and service built on Dancer2 versions 2.0.0 through 2.1.x, including indirect dependencies pulled in by other Perl distributions, and flag any that enforce authorization by dying in a 'before' hook while also registering an on_hook_exception handler that halts the response - these are the only configurations affected and should be queued first for remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 al
Same weakness CWE-460 – Improper Cleanup on Thrown Exception
View allSame technique Information Disclosure
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | not-affected | - | - |
| trixie | not-affected | - | - |
| forky, sid | vulnerable | 2.1.0-1 | - |
| (unstable) | fixed | (unfixed) | - |
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today