Medium 6.5Published Sep 17, 2026

CVE-2026-85078sanic chunked trailer request smuggling allows hidden second request execution

Updated under an hour ago (2026-10-19 10:00 UTC)

Does this affect you?

It affects sanic-org sanic. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for sanic-org sanic

Exploited in the last 30 days

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness (CWE): CWE-444
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Awaiting Analysis
Record last updated: Sep 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

sanic-org sanic sanic_org:sanic (from the name)	before 24.12.1; from 25.12.0, < 25.12.1	CNA record

References

https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5x-refsource-confirm
https://github.com/sanic-org/sanic/pull/3164x-refsource-misc
https://github.com/sanic-org/sanic/pull/3165x-refsource-misc
https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22x-refsource-misc
https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6deax-refsource-misc
https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6x-refsource-misc
https://github.com/sanic-org/sanic/releases/tag/v24.12.1x-refsource-misc
https://github.com/sanic-org/sanic/releases/tag/v25.12.1x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.