CVE-2012-5572
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114...
CVE-2012-5572 is a medium vulnerability (CVSS 5.0) in Dancer, published June 26, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in libdancer-perl 1.3114+dfsg-1.
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
Exploit likelihood
What each source reports
NVD Score used
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
- Record
CVE-2012-5572- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
- Record
CVE-2012-5572- Updated
- 2026-11-02
EUVDEUVD-2012-5462 No score
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
- Record
EUVD-2012-5462- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cqwv-qc24-9rvm No score
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114...
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
- Record
GHSA-cqwv-qc24-9rvm- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
- Record
CVE-2012-5572- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-5572 No score
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
- Record
DEBIAN-CVE-2012-5572- Updated
- 2026-11-02
OSVMGASA-2013-0183 No score
Updated perl-Dancer package fixes CVE-2012-5572
A security flaw was found in the way Dancer.pm, lightweight yet powerful web application framework / Perl language module, performed sanitization of values to be used for cookie() and cookies() methods. A remote attacker could use this flaw to inject arbitrary headers into responses from (Perl) applications, that use Dancer.pm (CVE-2012-5572).
- Record
MGASA-2013-0183- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-5572 No score
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
- Record
UBUNTU-CVE-2012-5572- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libdancer-perlDebian:12 |
before 1.3114+dfsg-1 | 1.3114+dfsg-1 |
libdancer-perlDebian:13 |
before 1.3114+dfsg-1 | 1.3114+dfsg-1 |
libdancer-perlDebian:14 |
before 1.3114+dfsg-1 | 1.3114+dfsg-1 |
perl-DancerMageia:2 |
before 1.311.500-1.mga2 | 1.311.500-1.mga2 |
perl-DancerMageia:3 |
before 1.311.500-1.mga3 | 1.311.500-1.mga3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |