Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by sanic-org
CVE-2026-85078 (GCVE-0-2026-85078)
Vulnerability from nvd – Published: 2026-09-17 14:28 – Updated: 2026-09-17 19:19
VLAI
EPSS
VEX
Title
sanic chunked trailer request smuggling allows hidden second request execution
Summary
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:06 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/sanic-org/sanic/security/advis… | x_refsource_CONFIRM |
| https://github.com/sanic-org/sanic/pull/3164 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/pull/3165 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/47349d6… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/69a10d3… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/a332796… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/releases/tag/v… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/releases/tag/v… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:06:16.358452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:19:53.849Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sanic",
"vendor": "sanic-org",
"versions": [
{
"status": "affected",
"version": "\u003c 24.12.1"
},
{
"status": "affected",
"version": "\u003e= 25.12.0, \u003c 25.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sanic is an opensource python web server/framework. In version 25.12.0, Sanic\u0027s core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:28:37.286Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3164",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3164"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3165",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3165"
},
{
"name": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22"
},
{
"name": "https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea"
},
{
"name": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1"
}
],
"source": {
"advisory": "GHSA-wmj6-g64g-j7q5",
"discovery": "UNKNOWN"
},
"title": "sanic chunked trailer request smuggling allows hidden second request execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85078",
"datePublished": "2026-09-17T14:28:37.286Z",
"dateReserved": "2026-09-02T21:21:01.776Z",
"dateUpdated": "2026-09-17T19:19:53.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85077 (GCVE-0-2026-85077)
Vulnerability from nvd – Published: 2026-09-17 14:26 – Updated: 2026-09-17 14:26
VLAI
EPSS
VEX
Title
Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
Summary
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.
Severity
8.2 (High)
CWE
- CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/sanic-org/sanic/security/advis… | x_refsource_CONFIRM |
| https://github.com/sanic-org/sanic/pull/3164 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/pull/3165 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/47349d6… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/9a95bb1… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/a332796… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/releases/tag/v… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/releases/tag/v… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "sanic",
"vendor": "sanic-org",
"versions": [
{
"status": "affected",
"version": "\u003c 24.12.1"
},
{
"status": "affected",
"version": "\u003e= 25.12.0, \u003c 25.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-113",
"description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:26:39.826Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sanic-org/sanic/security/advisories/GHSA-m64h-22vf-48wm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-m64h-22vf-48wm"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3164",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3164"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3165",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3165"
},
{
"name": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22"
},
{
"name": "https://github.com/sanic-org/sanic/commit/9a95bb1c187558949606b915f5162c15f2db781b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/9a95bb1c187558949606b915f5162c15f2db781b"
},
{
"name": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1"
}
],
"source": {
"advisory": "GHSA-m64h-22vf-48wm",
"discovery": "UNKNOWN"
},
"title": "Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85077",
"datePublished": "2026-09-17T14:26:39.826Z",
"dateReserved": "2026-09-02T21:21:01.776Z",
"dateUpdated": "2026-09-17T14:26:39.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-35920 (GCVE-0-2022-35920)
Vulnerability from nvd – Published: 2022-08-01 21:35 – Updated: 2025-04-22 17:45
VLAI
EPSS
VEX
Title
Improper Limitation of a Pathname to a Restricted Directory in sanic
Summary
Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 15:40 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/sanic-org/sanic/security/advis… | x_refsource_CONFIRM |
| https://github.com/sanic-org/sanic/issues/2478 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/pull/2495 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:51:58.602Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/sanic-org/sanic/issues/2478"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/sanic-org/sanic/pull/2495"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-35920",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:40:06.042217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T17:45:43.669Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sanic",
"vendor": "sanic-org",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.6.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.12.2"
},
{
"status": "affected",
"version": "\u003c 20.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-01T21:35:27.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/issues/2478"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/2495"
}
],
"source": {
"advisory": "GHSA-8cw9-5hmv-77w6",
"discovery": "UNKNOWN"
},
"title": "Improper Limitation of a Pathname to a Restricted Directory in sanic",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-35920",
"STATE": "PUBLIC",
"TITLE": "Improper Limitation of a Pathname to a Restricted Directory in sanic"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "sanic",
"version": {
"version_data": [
{
"version_value": "\u003e= 22.0.0, \u003c 22.6.1"
},
{
"version_value": "\u003e= 21.0.0, \u003c 21.12.2"
},
{
"version_value": "\u003c 20.12.7"
}
]
}
}
]
},
"vendor_name": "sanic-org"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6",
"refsource": "CONFIRM",
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6"
},
{
"name": "https://github.com/sanic-org/sanic/issues/2478",
"refsource": "MISC",
"url": "https://github.com/sanic-org/sanic/issues/2478"
},
{
"name": "https://github.com/sanic-org/sanic/pull/2495",
"refsource": "MISC",
"url": "https://github.com/sanic-org/sanic/pull/2495"
}
]
},
"source": {
"advisory": "GHSA-8cw9-5hmv-77w6",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-35920",
"datePublished": "2022-08-01T21:35:27.000Z",
"dateReserved": "2022-07-15T00:00:00.000Z",
"dateUpdated": "2025-04-22T17:45:43.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-85078 (GCVE-0-2026-85078)
Vulnerability from cvelistv5 – Published: 2026-09-17 14:28 – Updated: 2026-09-17 19:19
VLAI
EPSS
VEX
Title
sanic chunked trailer request smuggling allows hidden second request execution
Summary
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:06 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/sanic-org/sanic/security/advis… | x_refsource_CONFIRM |
| https://github.com/sanic-org/sanic/pull/3164 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/pull/3165 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/47349d6… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/69a10d3… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/a332796… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/releases/tag/v… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/releases/tag/v… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:06:16.358452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:19:53.849Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sanic",
"vendor": "sanic-org",
"versions": [
{
"status": "affected",
"version": "\u003c 24.12.1"
},
{
"status": "affected",
"version": "\u003e= 25.12.0, \u003c 25.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sanic is an opensource python web server/framework. In version 25.12.0, Sanic\u0027s core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:28:37.286Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3164",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3164"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3165",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3165"
},
{
"name": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22"
},
{
"name": "https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea"
},
{
"name": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1"
}
],
"source": {
"advisory": "GHSA-wmj6-g64g-j7q5",
"discovery": "UNKNOWN"
},
"title": "sanic chunked trailer request smuggling allows hidden second request execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85078",
"datePublished": "2026-09-17T14:28:37.286Z",
"dateReserved": "2026-09-02T21:21:01.776Z",
"dateUpdated": "2026-09-17T19:19:53.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85077 (GCVE-0-2026-85077)
Vulnerability from cvelistv5 – Published: 2026-09-17 14:26 – Updated: 2026-09-17 14:26
VLAI
EPSS
VEX
Title
Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
Summary
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.
Severity
8.2 (High)
CWE
- CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/sanic-org/sanic/security/advis… | x_refsource_CONFIRM |
| https://github.com/sanic-org/sanic/pull/3164 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/pull/3165 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/47349d6… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/9a95bb1… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/a332796… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/releases/tag/v… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/releases/tag/v… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "sanic",
"vendor": "sanic-org",
"versions": [
{
"status": "affected",
"version": "\u003c 24.12.1"
},
{
"status": "affected",
"version": "\u003e= 25.12.0, \u003c 25.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-113",
"description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:26:39.826Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sanic-org/sanic/security/advisories/GHSA-m64h-22vf-48wm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-m64h-22vf-48wm"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3164",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3164"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3165",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3165"
},
{
"name": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22"
},
{
"name": "https://github.com/sanic-org/sanic/commit/9a95bb1c187558949606b915f5162c15f2db781b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/9a95bb1c187558949606b915f5162c15f2db781b"
},
{
"name": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1"
}
],
"source": {
"advisory": "GHSA-m64h-22vf-48wm",
"discovery": "UNKNOWN"
},
"title": "Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85077",
"datePublished": "2026-09-17T14:26:39.826Z",
"dateReserved": "2026-09-02T21:21:01.776Z",
"dateUpdated": "2026-09-17T14:26:39.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-35920 (GCVE-0-2022-35920)
Vulnerability from cvelistv5 – Published: 2022-08-01 21:35 – Updated: 2025-04-22 17:45
VLAI
EPSS
VEX
Title
Improper Limitation of a Pathname to a Restricted Directory in sanic
Summary
Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 15:40 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/sanic-org/sanic/security/advis… | x_refsource_CONFIRM |
| https://github.com/sanic-org/sanic/issues/2478 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/pull/2495 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:51:58.602Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/sanic-org/sanic/issues/2478"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/sanic-org/sanic/pull/2495"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-35920",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:40:06.042217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T17:45:43.669Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sanic",
"vendor": "sanic-org",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.6.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.12.2"
},
{
"status": "affected",
"version": "\u003c 20.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-01T21:35:27.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/issues/2478"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/2495"
}
],
"source": {
"advisory": "GHSA-8cw9-5hmv-77w6",
"discovery": "UNKNOWN"
},
"title": "Improper Limitation of a Pathname to a Restricted Directory in sanic",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-35920",
"STATE": "PUBLIC",
"TITLE": "Improper Limitation of a Pathname to a Restricted Directory in sanic"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "sanic",
"version": {
"version_data": [
{
"version_value": "\u003e= 22.0.0, \u003c 22.6.1"
},
{
"version_value": "\u003e= 21.0.0, \u003c 21.12.2"
},
{
"version_value": "\u003c 20.12.7"
}
]
}
}
]
},
"vendor_name": "sanic-org"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6",
"refsource": "CONFIRM",
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6"
},
{
"name": "https://github.com/sanic-org/sanic/issues/2478",
"refsource": "MISC",
"url": "https://github.com/sanic-org/sanic/issues/2478"
},
{
"name": "https://github.com/sanic-org/sanic/pull/2495",
"refsource": "MISC",
"url": "https://github.com/sanic-org/sanic/pull/2495"
}
]
},
"source": {
"advisory": "GHSA-8cw9-5hmv-77w6",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-35920",
"datePublished": "2022-08-01T21:35:27.000Z",
"dateReserved": "2022-07-15T00:00:00.000Z",
"dateUpdated": "2025-04-22T17:45:43.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}