The vulnerability in Dancer2 (versions <2.2.0) arises because the headers_to_array routine removes CR and LF characters from header values but not from header names. Consequently, malicious header names containing CRLF sequences reach the PSGI server unaltered. If the server does not validate header keys, these sequences cause the server to write additional headers to the HTTP response, enabling an attacker to inject arbitrary headers by manipulating request data used to derive header names.

An attacker who can control the header name in the HTTP response can inject additional headers by exploiting the improper neutralization of CRLF sequences. This can lead to HTTP response splitting, potentially allowing header injection attacks, cache poisoning, cross-site scripting, or other downstream impacts depending on how the injected headers are processed by clients or intermediaries.

Upgrade Dancer2 to version 2.2.0 or later, where this issue is fixed by properly stripping CR and LF characters from header names. Until then, ensure that header names derived from request data are validated and sanitized to prevent CRLF injection. No official patch link is provided, so consult the Dancer2 project or CPAN for the fixed version.