Is CVE-2026-85078 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85078 being exploited in the wild.

How severe is CVE-2026-85078?

Medium severity, with a CVSS score of 6.5, published 17 September 2026.

Which products and versions are affected?

sanic (PyPI) ECOSYSTEM:introduced=0,fixed=24.12.1, ECOSYSTEM:introduced=0,fixed=24.12.1,introduced=25.12.0,fixed=25.12.1.

Is there a fix for CVE-2026-85078?

Yes. sanic (PyPI): upgrade to 24.12.1, 25.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-85078?

Check whether you run sanic (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85078: Sanic HTTP chunked trailer request smuggling

CVE-2026-85078 · Severity: medium · CVSS 6.5 · Published 2026-09-17

Sanic's HTTP/1.1 request parser fails to fully consume trailer data after chunked request bodies, allowing attackers to smuggle hidden HTTP requests on the same connection. A single malicious TCP packet can trigger two separate backend responses, enabling attackers to bypass firewall rules, cache poisoning, or execute unintended backend operations that would normally be rejected.

Technologies: sanic (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-85078 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85078 being exploited in the wild.
How severe is CVE-2026-85078?: Medium severity, with a CVSS score of 6.5, published 17 September 2026.
Which products and versions are affected?: sanic (PyPI) ECOSYSTEM:introduced=0,fixed=24.12.1, ECOSYSTEM:introduced=0,fixed=24.12.1,introduced=25.12.0,fixed=25.12.1.
Is there a fix for CVE-2026-85078?: Yes. sanic (PyPI): upgrade to 24.12.1, 25.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-85078?: Check whether you run sanic (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sanic (PyPI): upgrade to 24.12.1, 25.12.1 or later
```
pip install "sanic>=25.12.1"
```

Technical details

Sanic's HTTP/1.1 parser has a request-boundary integrity failure in chunked transfer encoding handling. After the terminating zero-length chunk marker (0\r\n), the RFC 7230 trailer-part should be fully consumed before buffer reuse. Instead, Sanic leaves attacker-controlled bytes in the connection buffer that are then parsed as a new request line. The vulnerability affects keep-alive connections and requires only network access to send a malformed chunked POST request. An attacker can craft a single TCP payload with a chunked request followed by hidden request data in the trailer region, causing the backend to execute that second request as if it were independently sent. The proof demonstrates routing of the smuggled request (returning 404 for nonexistent paths) and method parsing changes (":GET" from field name offset). Patches are available in versions 24.12.1 and 25.12.1.

Affected products

sanic-org sanic < 24.12.1, >= 25.12.0, < 25.12.1

Identifiers

CVE-2026-85078
GHSA-wmj6-g64g-j7q5
PYSEC-2026-4162

Timeline

2026-07-17: disclosed
2026-09-17: advisory: GitHub Security Advisory GHSA-wmj6-g64g-j7q5
2026-09-17: patched: Versions 24.12.1 and 25.12.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.