Hi,

The following vulnerabilities were published for libdancer2-perl.

CVE-2026-93709[0]:
| Dancer2 versions before 2.2.0 for Perl serve a layout as a page when
| an equivalent spelling of its path misses the guard in the AutoPage
| handler.  The handler compares the request path against the layout
| directory name as text, while the lookup that follows canonicalises
| it. A doubled slash, a dot segment, a percent-encoded slash, or a
| different capitalisation on a case-insensitive filesystem therefore
| misses the guard.  The handler is off by default, enabled with
| auto_page. The layout wrapping every page is already public, so this
| discloses one of the application's other layouts.


CVE-2026-93710[1]:
| Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route
| that a dying hook refused when the exception handler halts the
| response in compile_hooks.  A hook that dies fires
| core.app.hook_exception, then calls cleanup unless the failing hook
| is the exception handler. A handler that halts does not stop that
| cleanup, which discards the request, response and session the
| dispatcher has yet to read, so the refused route runs.  The handler
| has to halt the response object by calling its halt method or
| setting is_halted: the halt keyword unwinds through with_return
| before cleanup runs.  A check in a before hook is not enforced: the
| caller gets the refusal, while the route body runs and its writes
| land.


CVE-2026-93711[2]:
| Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from
| response header names in headers_to_array.  The routine removes CR
| and LF from each header value but not from the name. A name carrying
| them therefore reaches the PSGI server intact. A server that does
| not validate keys writes it to the wire, so the bytes after the CRLF
| arrive as their own header line.  The application has to derive the
| header name from request data, not just the value.  An attacker who
| controls that data adds their own headers and splits the response.


CVE-2026-93712[3]:
| Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from
| outside public_dir via relative path segments in the File route
| handler.  The handler joins the request path onto public_dir without
| collapsing relative segments, and checks only that the result is a
| readable regular file. A request for `/../outside.txt` escapes
| public_dir, and percent-encoding the dots reaches the same file.
| The handler is off by default. An application is affected once it
| names File in route_handlers and sets static_handler to 0, which
| otherwise refuses a dot segment before the route runs.  Any file the
| worker process can read is served to an unauthenticated request,
| including the application's config.yml above public_dir.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-93709
https://www.cve.org/CVERecord?id=CVE-2026-93709
[1] https://security-tracker.debian.org/tracker/CVE-2026-93710
https://www.cve.org/CVERecord?id=CVE-2026-93710
[2] https://security-tracker.debian.org/tracker/CVE-2026-93711
https://www.cve.org/CVERecord?id=CVE-2026-93711
[3] https://security-tracker.debian.org/tracker/CVE-2026-93712
https://www.cve.org/CVERecord?id=CVE-2026-93712

Regards,
Salvatore