Vulnerability Description
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb
- https://github.com/sanic-org/sanic/commit/9a95bb1c187558949606b915f5162c15f2db78
- https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8
- https://github.com/sanic-org/sanic/pull/3164
- https://github.com/sanic-org/sanic/pull/3165
- https://github.com/sanic-org/sanic/releases/tag/v24.12.1
- https://github.com/sanic-org/sanic/releases/tag/v25.12.1
- https://github.com/sanic-org/sanic/security/advisories/GHSA-m64h-22vf-48wm
FAQ
What is CVE-2026-85077?
CVE-2026-85077 is a vulnerability with a CVSS score of 8.2 (HIGH). Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and val...
How severe is CVE-2026-85077?
CVE-2026-85077 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85077?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.