Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA sanic (sanic-org) Fixed in 24.12.1, 25.12.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-85077
References
Other 8
- https://github.com/sanic-org/sanic/security/advisories/GHSA-m64h-22vf-48wm
- https://github.com/sanic-org/sanic/pull/3164
- https://github.com/sanic-org/sanic/pull/3165
- https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22
- https://github.com/sanic-org/sanic/commit/9a95bb1c187558949606b915f5162c15f2db781b
- https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6
- https://github.com/sanic-org/sanic/releases/tag/v24.12.1
- https://github.com/sanic-org/sanic/releases/tag/v25.12.1
More sanic-org vulnerabilities
- TI-2026-58442 sanic chunked trailer request smuggling allows hidden second request execution CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-85077 · CVE Program
- CVE-2026-85077 · NVD
- FIRST EPSS
- CVE-2026-85077 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences