If not quite insecure in and of itself, use CGI::Carp qw/fatalsToBrowser/; in production code is potentially helpful to an attacker.

In production use, you don't need to give away the information about why the iteration failed. Log it, but don't tell the attacker something that may provide insight into your security efforts.