Is CVE-2026-85077 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85077 being exploited in the wild.

How severe is CVE-2026-85077?

High severity, with a CVSS score of 8.2, published 17 September 2026.

Which products and versions are affected?

Sanic Sanic Prior to 24.12.1, and 25.12.0.

Is there a fix for CVE-2026-85077?

A patch was published on 2026-05-31: Fix available in versions 24.12.1 and 25.12.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85077 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85077?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85077: Sanic HTTP/1.1 response header injection vulnerability

CVE-2026-85077 · Severity: high · CVSS 8.2 · Published 2026-09-17

Sanic is an open-source Python web server and framework used to build web applications. A vulnerability in Sanic's HTTP response handling allows attackers to inject carriage-return and line-feed characters into response headers, which can lead to cache poisoning, session fixation through injected cookies, or corruption of security headers. Applications that accept attacker-controlled data in response headers, file downloads, or cookie attributes are particularly at risk.

Quick answers

Is CVE-2026-85077 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85077 being exploited in the wild.
How severe is CVE-2026-85077?: High severity, with a CVSS score of 8.2, published 17 September 2026.
Which products and versions are affected?: Sanic Sanic Prior to 24.12.1, and 25.12.0.
Is there a fix for CVE-2026-85077?: A patch was published on 2026-05-31: Fix available in versions 24.12.1 and 25.12.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85077 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85077?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a header injection flaw in sanic/response/types.py where HTTP/1.1 response header names and values are serialized without validation to reject carriage-return (CR) and line-feed (LF) characters. This allows attackers to inject newline sequences that split HTTP responses and inject arbitrary headers. The attack vector is network-based and requires the application to place untrusted data in response.headers, file() filename parameters, or cookie path/domain attributes. Depending on intermediary proxies and application behavior, this enables session fixation, cache poisoning, and security header corruption. Patches are available in versions 24.12.1 and 25.12.1.

Affected products

Sanic Sanic Prior to 24.12.1, and 25.12.0

Timeline

2026-09-17: disclosed: CVE-2026-85077 published
2026-05-31: patched: Fix available in versions 24.12.1 and 25.12.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.