sanic-org vulnerabilities

Products

• sanic 3

Latest sanic-org CVEs

Newest publication first

1. CVE-2026-85078 sanic chunked trailer request smuggling allows hidden second request execution

   Published 2026-09-17

   Medium·CVSS 6.5 EPSS 0.51%

   Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place...

2. CVE-2026-85077 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses

   Published 2026-09-17

   High·CVSS 8.2 EPSS 0.49%

   Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that...

3. CVE-2022-35920 Improper Limitation of a Pathname to a Restricted Directory in sanic

   Published 2022-08-01

   High·CVSS 7.5 EPSS 1.2%

   Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.