CVE-2026-85078: Sanic HTTP/1.1 Chunked Trailer Request Smuggling Vulnerability
Summary
CVE-2026-85078: sanic chunked trailer request smuggling allows hidden second request execution. Affects sanic across 2 version ranges.
< 24.12.1
>= 25.12.0, < 25.12.1
Fixed in 24.12.1 or 25.12.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sanic is a Python web framework designed for fast HTTP responses, built on asynchronous capabilities. It is widely used for building web applications and APIs due to its speed and efficiency. However, a critical vulnerability has been identified in its HTTP/1.1 chunked-body handling, which can lead to request smuggling attacks, compromising the integrity of HTTP request boundaries.
Vulnerability Detail
The vulnerability arises from Sanic's failure to fully consume the 'trailer-part' after the terminating '0\r\n' chunk in chunked HTTP requests. This oversight allows attacker-controlled bytes to remain in the connection buffer, which can be misinterpreted as the beginning of a new HTTP request on the same keep-alive connection. The implications are severe, as an attacker can execute hidden requests without the client's knowledge, leading to unauthorized actions and potential data breaches.
How To Fix
Latest published version: 25.12.1 as of 22 Oct 2026
pip install --upgrade "sanic==25.12.1"The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 24.12.124.12.1pip install --upgrade "sanic==24.12.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider rejecting any requests that contain bytes after the terminating '0\r\n' other than the expected final empty line. This can be implemented in your request handling logic to mitigate the risk of request smuggling.
Conclusion
The Sanic HTTP/1.1 chunked trailer request smuggling vulnerability (CVE-2026-85078) poses significant risks to applications using this framework. It is crucial to update to the latest patched versions or implement workarounds to protect against potential exploitation.
See every vulnerability recorded for sanic →
FAQ
CVE-2026-85078 is a vulnerability in the Sanic web framework that allows for HTTP request smuggling through improper handling of chunked trailer requests.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized request execution, data breaches, and integrity issues within your web application.
Yes, the CVSS score for this vulnerability is 6.5, indicating a medium severity level.
If you cannot update immediately, implement a workaround by rejecting requests with unexpected bytes after the terminating chunk to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for sanic.
