# CVE-2026-85078: Sanic HTTP chunked trailer request smuggling

Source: https://junglewise.ai/threats/cve-2026-85078-sanic-http-chunked-trailer-request-smuggling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85078 · Severity: medium · CVSS 6.5 · Published 2026-09-17

Sanic's HTTP/1.1 request parser fails to fully consume trailer data after chunked request bodies, allowing attackers to smuggle hidden HTTP requests on the same connection. A single malicious TCP packet can trigger two separate backend responses, enabling attackers to bypass firewall rules, cache poisoning, or execute unintended backend operations that would normally be rejected.

Technologies: [sanic (PyPI)](https://junglewise.ai/threats/technologies/sanic). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-85078 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85078 being exploited in the wild.

**How severe is CVE-2026-85078?** Medium severity, with a CVSS score of 6.5, published 17 September 2026.

**Which products and versions are affected?** sanic (PyPI) ECOSYSTEM:introduced=0,fixed=24.12.1, ECOSYSTEM:introduced=0,fixed=24.12.1,introduced=25.12.0,fixed=25.12.1.

**Is there a fix for CVE-2026-85078?** Yes. sanic (PyPI): upgrade to 24.12.1, 25.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-85078?** Check whether you run sanic (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sanic (PyPI): upgrade to 24.12.1, 25.12.1 or later

  ```sh
  pip install "sanic>=25.12.1"
  ```


## Technical details

Sanic's HTTP/1.1 parser has a request-boundary integrity failure in chunked transfer encoding handling. After the terminating zero-length chunk marker (0\r\n), the RFC 7230 trailer-part should be fully consumed before buffer reuse. Instead, Sanic leaves attacker-controlled bytes in the connection buffer that are then parsed as a new request line. The vulnerability affects keep-alive connections and requires only network access to send a malformed chunked POST request. An attacker can craft a single TCP payload with a chunked request followed by hidden request data in the trailer region, causing the backend to execute that second request as if it were independently sent. The proof demonstrates routing of the smuggled request (returning 404 for nonexistent paths) and method parsing changes (":GET" from field name offset). Patches are available in versions 24.12.1 and 25.12.1.

## Affected products

- sanic-org sanic < 24.12.1, >= 25.12.0, < 25.12.1

## Identifiers

- CVE-2026-85078
- GHSA-wmj6-g64g-j7q5
- PYSEC-2026-4162

## Timeline

- 2026-07-17: disclosed
- 2026-09-17: advisory: GitHub Security Advisory GHSA-wmj6-g64g-j7q5
- 2026-09-17: patched: Versions 24.12.1 and 25.12.1 released with fix

## References

- [https://api.github.com/users/lalalala5678](https://api.github.com/users/lalalala5678)
- [https://github.com/lalalala5678](https://github.com/lalalala5678)
- [https://api.github.com/users/lalalala5678/gists%7B/gist_id%7D](https://api.github.com/users/lalalala5678/gists%7B/gist_id%7D)
- [https://api.github.com/users/lalalala5678/repos](https://api.github.com/users/lalalala5678/repos)
- [https://avatars.githubusercontent.com/u/121565756?v=4](https://avatars.githubusercontent.com/u/121565756?v=4)
- [https://api.github.com/users/lalalala5678/events%7B/privacy%7D](https://api.github.com/users/lalalala5678/events%7B/privacy%7D)

## Related threats

- [PYSEC-2026-918 - sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs](https://junglewise.ai/threats/cve-2022-35920-sanic-vulnerable-to-path-traversal-when-using-app-static-if-using)
- [Server crash if running Python 3.10 w/ Sanic 20.12](https://junglewise.ai/threats/server-crash-if-running-python-3-10-w-sanic-20-12-e0de2ea0)
- [PYSEC-2017-40 - Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.](https://junglewise.ai/threats/cve-2017-16762-sanic-arbitrary-file-read-and-directory-traversal)