sanic-org Sanic up to 24.12.0/25.12.0 Response Pipeline sanic/response/types.py filename/domain/path session fixiation

Summaryinfo

A vulnerability was found in sanic-org Sanic up to 24.12.0/25.12.0 and classified as critical. This affects an unknown function of the file sanic/response/types.py of the component Response Pipeline. Executing a manipulation of the argument filename/domain/path can lead to session fixiation. This vulnerability is registered as CVE-2026-85077. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in sanic-org Sanic up to 24.12.0/25.12.0 and classified as critical. This vulnerability affects an unknown code of the file sanic/response/types.py of the component Response Pipeline. The manipulation of the argument filename/domain/path with an unknown input leads to a session fixiation vulnerability. The CWE definition for the vulnerability is CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-85077 since 09/02/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 24.12.1 or 25.12.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• sanic-org

Name

• Sanic

Version

• 24.0
• 24.1
• 24.2
• 24.3
• 24.4
• 24.5
• 24.6
• 24.7
• 24.8
• 24.9
• 24.10
• 24.11
• 24.12.0
• 25.0
• 25.1
• 25.2
• 25.3
• 25.4
• 25.5
• 25.6
• 25.7
• 25.8
• 25.9
• 25.10
• 25.11
• 25.12.0

Website

• Product: https://github.com/sanic-org/sanic/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion