Request Smuggling Vulnerability in Sanic Web Framework
CVE-2026-85078

6.5MEDIUM

Key Information:

Vendor

Sanic-org

Status
Sanic
Vendor
CVE Published:
17 September 2026

What is CVE-2026-85078?

Sanic, an open-source Python web server/framework, contains a vulnerability that impacts its handling of HTTP/1.1 chunked bodies in version 25.12.0. This flaw allows a remote unauthenticated attacker to exploit the chunked-body handling inefficiencies, leading to potential request smuggling attacks. If an attacker sends specially crafted bytes in the trailer part of a chunked request, they may inadvertently manipulate the existing request context, causing the server to parse and route an invisible second request in addition to the original. This breaks the integrity of HTTP request boundaries, especially when Sanic operates behind intermediaries. Users are strongly advised to upgrade to version 25.12.1, which addresses this issue and enhances overall security.

Affected Version(s)

sanic < 24.12.1 < 24.12.1

sanic >= 25.12.0, < 25.12.1 < 25.12.0, 25.12.1

References

https://github.com/sanic-org/sanic/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/sanic-org/sanic/pull/3164
x_refsource_MISC
https://github.com/sanic-org/sanic/pull/3165
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.