{"id":"CVE-2026-85078","aliases":["GHSA-wmj6-g64g-j7q5"],"url":"https://o3.security/vulnerability/CVE-2026-85078","summary":"sanic chunked trailer request smuggling allows hidden second request execution","details":"Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.","published":"2026-09-17T14:28:37.286Z","modified":"2026-09-18T03:48:32.375883007Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"sanic","fixedVersion":"24.12.1"},{"ecosystem":"PyPI","name":"sanic","fixedVersion":"25.12.1"}],"fix":{"url":"https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22","label":"sanic-org/sanic@47349d6"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85078.json"},{"type":"FIX","url":"https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22"},{"type":"FIX","url":"https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea"},{"type":"FIX","url":"https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6"},{"type":"FIX","url":"https://github.com/sanic-org/sanic/pull/3164"},{"type":"FIX","url":"https://github.com/sanic-org/sanic/pull/3165"},{"type":"WEB","url":"https://github.com/sanic-org/sanic/releases/tag/v24.12.1"},{"type":"WEB","url":"https://github.com/sanic-org/sanic/releases/tag/v25.12.1"},{"type":"ADVISORY","url":"https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85078"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T03:48:32.375883007Z"}}