CVE-2026-85078: CVE-2026-85078: HTTP Request Smuggling via Chunked Trailers in Sanic Core HTTP Parser

CVE-2026-85078: HTTP Request Smuggling via Chunked Trailers in Sanic Core HTTP Parser

Vulnerability ID: CVE-2026-85078
CVSS Score: 6.5
Published: 2026-09-17

CVE-2026-85078 describes a critical request-boundary integrity vulnerability (HTTP Request Smuggling) in Sanic, an open-source high-performance Python web server and framework. The vulnerability exists within Sanic's core HTTP/1.1 chunked-body parser. Prior to the patched versions, when processing a chunked transfer-encoded request, Sanic's parser failed to fully consume or validate the trailer-part following the terminating zero-size chunk.

TL;DR

Sanic's HTTP/1.1 chunked parser fails to process or reject trailing headers after a zero-size chunk. Attackers can leverage this on keep-alive connections to smuggle subsequent HTTP requests, bypassing proxy security filters.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-444
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 6.5
• Exploit Status: PoC (Proof-of-Concept)
• KEV Status: Not Listed
• Remediation: Upgrade to Sanic 24.12.1 / 25.12.1

Affected Systems

• Sanic < 24.12.1
• Sanic 25.12.0
• sanic: < 24.12.1 (Fixed in: 24.12.1)
• sanic: == 25.12.0 (Fixed in: 25.12.1)

Code Analysis

Commit: a332796

Fix HTTP/1.1 chunked parser vulnerability by rejecting non-empty trailers and closing keep-alive connection on failure.

Commit: 47349d6

Backport of chunked HTTP trailer rejection to v24 LTS branch.

Commit: 69a10d3

Backport of chunked HTTP trailer rejection to v25 LTS branch.

Exploit Details

• GitHub Security Advisory: Advisory details for GHSA-wmj6-g64g-j7q5 containing conceptual parser unit tests.

Mitigation Strategies

• Upgrade Sanic web server to patched versions.
• Configure intermediate proxies to strip HTTP trailers.
• Implement robust request body buffering on Nginx or HAProxy.

Remediation Steps:

1. Identify all deployment environments running Sanic web server.
2. For deployments on v24 LTS, upgrade Sanic package to at least version 24.12.1.
3. For deployments on v25 LTS, upgrade Sanic package to at least version 25.12.1.
4. Verify the update by issuing a chunked HTTP request containing trailers and checking if the server drops the connection.

References

• GitHub Security Advisory GHSA-wmj6-g64g-j7q5
• CVE Registry Entry for CVE-2026-85078

---

Read the full report for CVE-2026-85078 on our website for more details including interactive diagrams and full exploit analysis.