CVE-2026-85078Medium· 6.5▾ SunlitSanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer.…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
sanic < 24.12.1sanic >= 25.12.0, < 25.12.1Patched in:
sanic 24.12.1sanic 25.12.1Source: https://github.com/advisories/GHSA-wmj6-g64g-j7q5
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85077High· 8.2Sanic is an opensource python web server/framework
CVE-2022-35920High· 8.3sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
CVE-2026-48746Critical· 9.1vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-69243High· 7.0AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-48710Medium· 6.5Starlette is a lightweight ASGI framework/toolkit
CVE-2026-93574Medium· 6.5A flaw was found in Netty's `netty-codec-http` component