[From nobody Tue Sep 29 16:51:07 2026 Received: (at submit) by bugs.debian.org; 22 Sep 2026 18:49:58 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-111.0 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FOURLA, FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST, XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 45; hammy, 150; neutral, 165; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:55454) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1x95Z0-001pO2-1X for submit@bugs.debian.org; Tue, 22 Sep 2026 18:49:58 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Date:Message-ID:Subject:To:From: Content-Transfer-Encoding:MIME-Version:Content-Type:Reply-To:Cc:Content-ID: Content-Description:In-Reply-To:References; bh=cMfVp3loWSbAE1abvvCG4vks9tHZicD9I71WI2XoLE4=; b=r1fWyPEiNMCeKhrWV8CvjxQRTI Uyhlnzu87lt9ueWX2TIiIFoVa3pCF3civrQiW6TF4/e8Qga+yt786hgyascFyay8WdtVlnulxtifU MMaqXYvhNIkdpUsD5Cz0LOSZ7EV7mCy+mxjrFYFt9N/op+/xUK6o9ZpwfCXbEjhsVaUWcQQsiqjkK kXvXQpaBgup2pLKTkAvnXml05gfz/XNO+mZGLJijL0rJI1XL27Kb4B6E5SxmTaJslh+WQZOW08Xj6 wjCAr0ooKK+9/eteWE9sflnDl7owjVCgh8qQOeGMHcTndjbEkBYtpwAkSzd0D/9EBvW+yMTV3ZWT1 meAtxeFQ==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1x95Yy-003Bak-0b for submit@bugs.debian.org; Tue, 22 Sep 2026 18:49:57 +0000 Received: from eldamar.lan (localhost [IPv6:::1]) by eldamar.lan (Postfix) with ESMTP id 3657DDC0D54 for <submit@bugs.debian.org>; Tue, 22 Sep 2026 20:49:55 +0200 (CEST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: libdancer2-perl: CVE-2026-93709 CVE-2026-93710 CVE-2026-93711 CVE-2026-93712 Message-ID: <179010299516.216621.5067930484317050586.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Tue, 22 Sep 2026 20:49:55 +0200 X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: libdancer2-perl Version: 2.1.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerabilities were published for libdancer2-perl. CVE-2026-93709[0]: | Dancer2 versions before 2.2.0 for Perl serve a layout as a page when | an equivalent spelling of its path misses the guard in the AutoPage | handler. The handler compares the request path against the layout | directory name as text, while the lookup that follows canonicalises | it. A doubled slash, a dot segment, a percent-encoded slash, or a | different capitalisation on a case-insensitive filesystem therefore | misses the guard. The handler is off by default, enabled with | auto_page. The layout wrapping every page is already public, so this | discloses one of the application's other layouts. CVE-2026-93710[1]: | Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route | that a dying hook refused when the exception handler halts the | response in compile_hooks. A hook that dies fires | core.app.hook_exception, then calls cleanup unless the failing hook | is the exception handler. A handler that halts does not stop that | cleanup, which discards the request, response and session the | dispatcher has yet to read, so the refused route runs. The handler | has to halt the response object by calling its halt method or | setting is_halted: the halt keyword unwinds through with_return | before cleanup runs. A check in a before hook is not enforced: the | caller gets the refusal, while the route body runs and its writes | land. CVE-2026-93711[2]: | Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from | response header names in headers_to_array. The routine removes CR | and LF from each header value but not from the name. A name carrying | them therefore reaches the PSGI server intact. A server that does | not validate keys writes it to the wire, so the bytes after the CRLF | arrive as their own header line. The application has to derive the | header name from request data, not just the value. An attacker who | controls that data adds their own headers and splits the response. CVE-2026-93712[3]: | Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from | outside public_dir via relative path segments in the File route | handler. The handler joins the request path onto public_dir without | collapsing relative segments, and checks only that the result is a | readable regular file. A request for `/../outside.txt` escapes | public_dir, and percent-encoding the dots reaches the same file. | The handler is off by default. An application is affected once it | names File in route_handlers and sets static_handler to 0, which | otherwise refuses a dot segment before the route runs. Any file the | worker process can read is served to an unauthenticated request, | including the application's config.yml above public_dir. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-93709 https://www.cve.org/CVERecord?id=CVE-2026-93709 [1] https://security-tracker.debian.org/tracker/CVE-2026-93710 https://www.cve.org/CVERecord?id=CVE-2026-93710 [2] https://security-tracker.debian.org/tracker/CVE-2026-93711 https://www.cve.org/CVERecord?id=CVE-2026-93711 [3] https://security-tracker.debian.org/tracker/CVE-2026-93712 https://www.cve.org/CVERecord?id=CVE-2026-93712 Regards, Salvatore ]