CVE-2026-85078

{"id": "CVE-2026-85078", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85078", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T17:06:16.358452Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sanic-org", "product": "sanic", "versions": [{"status": "affected", "version": "< 24.12.1"}, {"status": "affected", "version": ">= 25.12.0, < 25.12.1"}]}]}], "published": "2026-09-17T15:16:55.153", "references": [{"url": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22", "source": "security-advisories@github.com"}, {"url": "https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea", "source": "security-advisories@github.com"}, {"url": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6", "source": "security-advisories@github.com"}, {"url": "https://github.com/sanic-org/sanic/pull/3164", "source": "security-advisories@github.com"}, {"url": "https://github.com/sanic-org/sanic/pull/3165", "source": "security-advisories@github.com"}, {"url": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1."}], "lastModified": "2026-09-30T17:31:44.573", "sourceIdentifier": "security-advisories@github.com"}