Back Linuxsecurity

Fedora 45 perl-Dancer2 Critical Deserialization Exploit 2026

Linuxsecurity •LinuxSecurity Advisories • September 29, 2026

CISA confirms exploitation of a Linux firewall flaw. Check if your systems need the fix. ×

Dancer2 is the new generation of Dancer, the lightweight web-framework for

Perl. It is a complete rewrite based on Moo and is meant to be easy and fun.

Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary blessed object — the entry point for DESTROY/AUTOLOAD/overload gadget chains — and !!perl/code could ask for a string eval. deserialize now sets $YAML::LoadBlessed = 0 and $YAML::LoadCode = 0 itself (localised) before loading, rather than relying on YAML.pm's ambient defaults, and the minimum YAML is raised to 1.30.

* Sun Sep 20 2026 Emmanuel Seyman - 2.2.1-1 - Update to 2.2.1 - Downsize version check to make no check the default

Fedora Update Notification FEDORA-2026-5e3eab9a07 2026-09-29 00:15:02.251264+00:00 Name : perl-Dancer2 Product : Fedora 45 Version : 2.2.1 Release : 1.fc45 URL : Summary : Lightweight yet powerful web application framework Description : Dancer2 is the new generation of Dancer, the lightweight web-framework for Perl. It is a complete rewrite based on Moo and is meant to be easy and fun.

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-5e3eab9a07' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Deserialization Vulnerability in Fedora 44 and 45 perl-Dancer2 A major deserialization vulnerability has been identified in the perl-Dancer2 framework affecting Fedora 44 and 45. CISA has confirmed exploitation of this flaw, which allows arbitrary object instantiation through YAML deserialization. The vulnerability arises from the Dancer2::Serializer::YAML::deserialize method, which improperly handles request bodies. This vulnerability is particularly concerning as it can lead to the execution of arbitrary code. The affected versions are perl-Dancer2 2.2.1 in both Fedora 44 and 45. Users are urged to apply the available patches immediately to mitigate the risk. The updates set $YAML::LoadBlessed and $YAML::LoadCode to 0 before loading, addressing the security issue. The updates can be installed using the dnf package manager. As of today, both updates have been released and are available for installation. 2 sources 73

Extracted Entities

Fedora 45 perl-Dancer2 Critical Deserialization Exploit 2026

The full story

Extracted Entities

CWE Weaknesses (1)

Domains (1)

Platforms (1)