Executive brief
Sanic is an open-source Python web server and framework used to build web applications. A vulnerability in Sanic's HTTP response handling allows attackers to inject carriage-return and line-feed characters into response headers, which can lead to cache poisoning, session fixation through injected cookies, or corruption of security headers. Applications that accept attacker-controlled data in response headers, file downloads, or cookie attributes are particularly at risk.
Technical details
The vulnerability is a header injection flaw in sanic/response/types.py where HTTP/1.1 response header names and values are serialized without validation to reject carriage-return (CR) and line-feed (LF) characters. This allows attackers to inject newline sequences that split HTTP responses and inject arbitrary headers. The attack vector is network-based and requires the application to place untrusted data in response.headers, file() filename parameters, or cookie path/domain attributes. Depending on intermediary proxies and application behavior, this enables session fixation, cache poisoning, and security header corruption. Patches are available in versions 24.12.1 and 25.12.1.
Affected products
- Sanic Sanic Prior to 24.12.1, and 25.12.0
Timeline
- 2026-09-17: disclosed: CVE-2026-85077 published
- 2026-05-31: patched: Fix available in versions 24.12.1 and 25.12.1