CVE-2026-85078

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.

• CWE-444

• https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22
• https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea
• https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6
• https://github.com/sanic-org/sanic/pull/3164
• https://github.com/sanic-org/sanic/pull/3165
• https://github.com/sanic-org/sanic/releases/tag/v24.12.1
• https://github.com/sanic-org/sanic/releases/tag/v25.12.1
• https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5

Published

Sep 17, 2026

Last Modified

Sep 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85062Colord is a tiny yet powerful tool for high-performance colo…6.9
• CVE-2026-85063node-csv is a full-featured CSV parser with a simple API tha…6.9
• CVE-2026-85068Network UPS Tools is a collection of programs which provide …2.4
• CVE-2026-8507Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have o…9.8
• CVE-2026-85076Cronicle is a multi-server task scheduler and runner, with a…9
• CVE-2026-85077Sanic is an opensource python web server/framework. Prior to…8.2
• CVE-2026-85079In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req …9.8
• CVE-2026-8508An improper authentication vulnerability in the "social_logi…6.5
• CVE-2026-85080In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembersh…9.1
• CVE-2026-85081The File Manager WordPress plugin before 8.0.5, FileOrganize…7.5
• CVE-2026-85082Root Browser Classic 3.3.0 passes the path of a selected SQL…8.5
• CVE-2026-85083The ANJIA AJL33PC0801 IP camera uses a hard-coded credential…6.8