CVE-2026-85077 sanic-org CVE debrief

Who should care

Sanic users and administrators, developers using Sanic in their applications, security teams responsible for web server security, and operators managing Sanic-based services should be aware of this vulnerability. They should assess their exposure, validate response header handling, and update to a fixed version of Sanic as a priority. Vulnerability management and security teams should also review and monitor for potential security issues related to thisCVE

Why it matters

CVE-2026-85077 is a high-severity vulnerability in Sanic, an open-source Python web server/framework. The issue allows for header injection, which can lead to various security problems. Sanic users and administrators should assess their exposure, validate response header handling in their applications, and update to a fixed version of Sanic as a priority.

• Potential for session fixation through injected cookies
• Risk of cache poisoning due to response splitting
• Possible security-header corruption
• Need for validation and updates to Sanic

Technical summary

The HTTP/1.1 response pipeline in Sanic's response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. This can allow attackers to inject headers and potentially split responses, leading to issues like session fixation, cache poisoning, or security-header corruption. The vulnerability is fixed in versions 24.12.1 and 25.12.1 of Sanic. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes are particularly vulnerable.

Defensive priority

High priority for Sanic users and administrators

Recommended defensive actions

• Review and update Sanic to version 24.12.1 or 25.12.1
• Assess and validate response header handling in applications using Sanic
• Monitor for potential security issues related to injected headers
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Sanic, an open-source Python web server/framework. The issue is related to the serialization of response header names and values without rejecting carriage-return or line-feed characters, which can lead to injected headers and potential security issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.