Executive brief
Sanic's HTTP/1.1 request parser fails to fully consume trailer data after chunked request bodies, allowing attackers to smuggle hidden HTTP requests on the same connection. A single malicious TCP packet can trigger two separate backend responses, enabling attackers to bypass firewall rules, cache poisoning, or execute unintended backend operations that would normally be rejected.
Technical details
Sanic's HTTP/1.1 parser has a request-boundary integrity failure in chunked transfer encoding handling. After the terminating zero-length chunk marker (0\r\n), the RFC 7230 trailer-part should be fully consumed before buffer reuse. Instead, Sanic leaves attacker-controlled bytes in the connection buffer that are then parsed as a new request line. The vulnerability affects keep-alive connections and requires only network access to send a malformed chunked POST request. An attacker can craft a single TCP payload with a chunked request followed by hidden request data in the trailer region, causing the backend to execute that second request as if it were independently sent. The proof demonstrates routing of the smuggled request (returning 404 for nonexistent paths) and method parsing changes (":GET" from field name offset). Patches are available in versions 24.12.1 and 25.12.1.
Affected products
- sanic-org sanic < 24.12.1, >= 25.12.0, < 25.12.1
Timeline
- 2026-07-17: disclosed
- 2026-09-17: advisory: GitHub Security Advisory GHSA-wmj6-g64g-j7q5
- 2026-09-17: patched: Versions 24.12.1 and 25.12.1 released with fix