Sanic Framework HTTP Response Header Injection Vulnerability in Affected Versions

CVE-2026-85077

What is CVE-2026-85077?

The Sanic framework, an open-source Python web server, is susceptible to an HTTP response header injection vulnerability. Prior to version 24.12.1 and in version 25.12.0, the framework fails to properly sanitize response header names and values, allowing attackers to insert carriage-return or line-feed characters. This flaw enables the manipulation of response headers, potentially leading to critical issues such as session fixation via injected cookies, cache poisoning, and corruption of security headers. It is crucial for users to upgrade to versions 24.12.1 or 25.12.1 to mitigate these risks.

References