https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 22:32:32 +0000 https://vulnerability.circl.lu/vuln/cve-2026-93710 <p><strong>Affected:</strong> Dancer2</p> <p>Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks.</p> <p>A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs.</p> <p>The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs.</p> <p>A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.</p> <p><strong>Affected:</strong> Dancer2</p> <p>Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks.</p> <p>A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs.</p> <p>The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs.</p> <p>A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.</p> https://vulnerability.circl.lu/vuln/cve-2026-93710