sanic chunked trailer request smuggling allows hidden second request execution
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sanic-org | sanic | before 24.12.1; 25.12.0 to before 25.12.1 | 24.12.1, 25.12.1 | Patch available | CNA |
| — | sanic (PyPI) | before 24.12.1 | 24.12.1 | Patch available | GHSA-wmj6-g64g-j7q5 |
| — | sanic (PyPI) | 25.12.0 to before 25.12.1 | 25.12.1 | Patch available | GHSA-wmj6-g64g-j7q5 |
- sanic Vendorsanic-org Affected before 24.12.1; 25.12.0 to before 25.12.1 Fixed in 24.12.1, 25.12.1 Patch available CNA
- sanic (PyPI) Vendor— Affected before 24.12.1 Fixed in 24.12.1 Patch available GHSA-wmj6-g64g-j7q5
- sanic (PyPI) Vendor— Affected 25.12.0 to before 25.12.1 Fixed in 25.12.1 Patch available GHSA-wmj6-g64g-j7q5
Remediation
- Fix · CNA sanic (sanic-org) Fixed in 24.12.1, 25.12.1
- Fix · GHSA-wmj6-g64g-j7q5 sanic (PyPI) Fixed in 24.12.1 Advisory →
- Fix · GHSA-wmj6-g64g-j7q5 sanic (PyPI) Fixed in 25.12.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-85078
- 2026-10-03 Alias added: GHSA-wmj6-g64g-j7q5
References
Other 9
- https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5
- https://github.com/sanic-org/sanic/pull/3164
- https://github.com/sanic-org/sanic/pull/3165
- https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22
- https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea
- https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6
- https://github.com/sanic-org/sanic/releases/tag/v24.12.1
- https://github.com/sanic-org/sanic/releases/tag/v25.12.1
- https://github.com/sanic-org/sanic
More sanic-org vulnerabilities
- TI-2026-58441 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses CVSS 3.1HIGH 8.2
Sources
- CVE-2026-85078 · CVE Program
- CVE-2026-85078 · NVD
- FIRST EPSS
- GHSA-wmj6-g64g-j7q5 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-85078 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences