CVE-2026-85078

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.

• CWE-444

• https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22
• https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea
• https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6
• https://github.com/sanic-org/sanic/pull/3164
• https://github.com/sanic-org/sanic/pull/3165
• https://github.com/sanic-org/sanic/releases/tag/v24.12.1
• https://github.com/sanic-org/sanic/releases/tag/v25.12.1
• https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85058Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,…7.5
• CVE-2026-85061MapLibre GL JS is an interactive vector tile map library for…10
• CVE-2026-85062Colord is a tiny yet powerful tool for high-performance colo…6.9
• CVE-2026-85063node-csv is a full-featured CSV parser with a simple API tha…6.9
• CVE-2026-8507Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have o…9.8
• CVE-2026-85077Sanic is an opensource python web server/framework. Prior to…8.2
• CVE-2026-8508An improper authentication vulnerability in the "social_logi…6.5
• CVE-2026-85081The File Manager WordPress plugin before 8.0.5, FileOrganize…7.5
• CVE-2026-85082Root Browser Classic 3.3.0 passes the path of a selected SQL…8.5
• CVE-2026-85083The ANJIA AJL33PC0801 IP camera uses a hard-coded credential…6.8
• CVE-2026-85084Out-of-bounds Write and Improper Validation of Array Index v…6.3
• CVE-2026-85085The Canva Android App before 2.376.0 allowed an external ori…9.6