CVE-2026-85077

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.

• CWE-113

• https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22
• https://github.com/sanic-org/sanic/commit/9a95bb1c187558949606b915f5162c15f2db781b
• https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6
• https://github.com/sanic-org/sanic/pull/3164
• https://github.com/sanic-org/sanic/pull/3165
• https://github.com/sanic-org/sanic/releases/tag/v24.12.1
• https://github.com/sanic-org/sanic/releases/tag/v25.12.1
• https://github.com/sanic-org/sanic/security/advisories/GHSA-m64h-22vf-48wm

Published

Sep 17, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85057ZITADEL is an open source identity management platform. From…8.7
• CVE-2026-85058Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,…7.5
• CVE-2026-85061MapLibre GL JS is an interactive vector tile map library for…10
• CVE-2026-85062Colord is a tiny yet powerful tool for high-performance colo…6.9
• CVE-2026-85063node-csv is a full-featured CSV parser with a simple API tha…6.9
• CVE-2026-8507Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have o…9.8
• CVE-2026-85078Sanic is an opensource python web server/framework. In versi…6.5
• CVE-2026-8508An improper authentication vulnerability in the "social_logi…6.5
• CVE-2026-85081The File Manager WordPress plugin before 8.0.5, FileOrganize…
• CVE-2026-85082Root Browser Classic 3.3.0 passes the path of a selected SQL…8.5
• CVE-2026-85083The ANJIA AJL33PC0801 IP camera uses a hard-coded credential…6.8
• CVE-2026-85084Out-of-bounds Write and Improper Validation of Array Index v…6.3