CVE-2026-85077 in Sanic
Summary
by MITRE • 09/17/2026
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within the Sanic web framework constitutes a critical HTTP response splitting flaw arising from insufficient input validation during the serialization of HTTP headers. In versions prior to 24.12.1 and specifically in version 25.12.0, the internal logic responsible for constructing HTTP/1.1 responses fails to sanitize carriage return (CR) or line feed (LF) characters embedded within header names or values. This technical deficiency allows an attacker who can control data passed into response headers, file download filenames, or cookie attributes such as path and domain to inject arbitrary CRLF sequences directly into the outgoing HTTP stream. By inserting these newline characters, the attacker effectively terminates the current header line prematurely and initiates a new one, thereby manipulating the structure of the HTTP response sent back to the client.
This structural manipulation enables several severe operational impacts depending on how downstream proxies or clients interpret the malformed traffic. The most immediate risk is cache poisoning, where an attacker injects headers that cause intermediate caching servers like CDNs or reverse proxies to store and serve malicious content under legitimate URLs. This can lead to widespread distribution of phishing pages or malware if users retrieve cached responses tainted by the injected payload. Additionally, the ability to set arbitrary cookies facilitates session fixation attacks. By injecting a Set-Cookie header with an attacker-controlled value, it becomes possible to force a victim's browser into using a specific session identifier known to the attacker, thereby compromising authentication integrity and allowing unauthorized access to user accounts or sensitive application states.
Furthermore, the corruption of security headers represents another significant consequence of this vulnerability. If critical directives such as Content-Security-Policy, X-Frame-Options, or Strict-Transport-Security are overwritten or nullified through header injection, the application loses its defensive posture against cross-site scripting, clickjacking, and protocol downgrade attacks. This erosion of security controls leaves end-users exposed to a broader range of client-side exploits that would otherwise be mitigated by proper server configuration. The severity is compounded in environments where Sanic operates behind reverse proxies or load balancers, as these intermediaries may process the split responses unpredictably, potentially leading to request smuggling scenarios if the boundary between HTTP layers becomes ambiguous due to malformed header structures.
The root cause of this issue aligns with CWE-113, which describes Improper Neutralization of CRLF Sequences in HTTP Headers, commonly known as HTTP Response Splitting. From a threat modeling perspective utilizing the MITRE ATT&CK framework, this vulnerability supports techniques associated with Cache Poisoning (T1498) and Session Fixation (T1528), allowing adversaries to manipulate infrastructure state or hijack user sessions without direct authentication bypasses in many contexts. The flaw is not inherent to the HTTP protocol itself but rather a failure of the framework to enforce strict adherence to RFC 7230, which mandates that header fields must not contain unencoded CR and LF characters.
To mitigate this risk, organizations running affected versions of Sanic must immediately upgrade to version 24.12.1 or later, where the response serialization logic has been patched to explicitly reject or escape carriage return and line feed characters in all user-supplied header data. For applications unable to update immediately due to dependency constraints, a temporary workaround involves implementing custom middleware that sanitizes all inputs destined for headers, filenames, and cookie attributes before they are passed to Sanic's response handlers. This defensive coding practice should strip or encode any CRLF sequences present in the input stream. Additionally, deploying Web Application Firewalls with rules specifically designed to detect HTTP Response Splitting patterns can provide an additional layer of defense by blocking requests containing suspicious newline characters within header parameters until a permanent code fix is deployed.