Refine your search
3 vulnerabilities found for sanic by sanic-org
CVE-2026-85078 (GCVE-0-2026-85078)
Vulnerability from cvelistv5
Published
2026-09-17 14:28
Modified
2026-09-17 19:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Summary
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:06:16.358452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:19:53.849Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sanic",
"vendor": "sanic-org",
"versions": [
{
"status": "affected",
"version": "\u003c 24.12.1"
},
{
"status": "affected",
"version": "\u003e= 25.12.0, \u003c 25.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sanic is an opensource python web server/framework. In version 25.12.0, Sanic\u0027s core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:28:37.286Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3164",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3164"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3165",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3165"
},
{
"name": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22"
},
{
"name": "https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea"
},
{
"name": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1"
}
],
"source": {
"advisory": "GHSA-wmj6-g64g-j7q5",
"discovery": "UNKNOWN"
},
"title": "sanic chunked trailer request smuggling allows hidden second request execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85078",
"datePublished": "2026-09-17T14:28:37.286Z",
"dateReserved": "2026-09-02T21:21:01.776Z",
"dateUpdated": "2026-09-17T19:19:53.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85077 (GCVE-0-2026-85077)
Vulnerability from cvelistv5
Published
2026-09-17 14:26
Modified
2026-09-21 20:45
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Summary
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85077",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T20:45:00.743376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:45:15.589Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sanic",
"vendor": "sanic-org",
"versions": [
{
"status": "affected",
"version": "\u003c 24.12.1"
},
{
"status": "affected",
"version": "\u003e= 25.12.0, \u003c 25.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-113",
"description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:26:39.826Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sanic-org/sanic/security/advisories/GHSA-m64h-22vf-48wm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-m64h-22vf-48wm"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3164",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3164"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3165",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3165"
},
{
"name": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22"
},
{
"name": "https://github.com/sanic-org/sanic/commit/9a95bb1c187558949606b915f5162c15f2db781b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/9a95bb1c187558949606b915f5162c15f2db781b"
},
{
"name": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1"
}
],
"source": {
"advisory": "GHSA-m64h-22vf-48wm",
"discovery": "UNKNOWN"
},
"title": "Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85077",
"datePublished": "2026-09-17T14:26:39.826Z",
"dateReserved": "2026-09-02T21:21:01.776Z",
"dateUpdated": "2026-09-21T20:45:15.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-35920 (GCVE-0-2022-35920)
Vulnerability from cvelistv5
Published
2022-08-01 21:35
Modified
2025-04-22 17:45
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:51:58.602Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/sanic-org/sanic/issues/2478"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/sanic-org/sanic/pull/2495"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-35920",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:40:06.042217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T17:45:43.669Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sanic",
"vendor": "sanic-org",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.6.1"
},
{
"status": "affected",
"version": "\u003e= 21.0.0, \u003c 21.12.2"
},
{
"status": "affected",
"version": "\u003c 20.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-01T21:35:27.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/issues/2478"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/2495"
}
],
"source": {
"advisory": "GHSA-8cw9-5hmv-77w6",
"discovery": "UNKNOWN"
},
"title": "Improper Limitation of a Pathname to a Restricted Directory in sanic",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-35920",
"STATE": "PUBLIC",
"TITLE": "Improper Limitation of a Pathname to a Restricted Directory in sanic"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "sanic",
"version": {
"version_data": [
{
"version_value": "\u003e= 22.0.0, \u003c 22.6.1"
},
{
"version_value": "\u003e= 21.0.0, \u003c 21.12.2"
},
{
"version_value": "\u003c 20.12.7"
}
]
}
}
]
},
"vendor_name": "sanic-org"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6",
"refsource": "CONFIRM",
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6"
},
{
"name": "https://github.com/sanic-org/sanic/issues/2478",
"refsource": "MISC",
"url": "https://github.com/sanic-org/sanic/issues/2478"
},
{
"name": "https://github.com/sanic-org/sanic/pull/2495",
"refsource": "MISC",
"url": "https://github.com/sanic-org/sanic/pull/2495"
}
]
},
"source": {
"advisory": "GHSA-8cw9-5hmv-77w6",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-35920",
"datePublished": "2022-08-01T21:35:27.000Z",
"dateReserved": "2022-07-15T00:00:00.000Z",
"dateUpdated": "2025-04-22T17:45:43.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}