CVE-2026-85078Medium· 6.5▾ SunlitSanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer.…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.5%
Last analysed / modified upstream
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
sanic < 24.12.1sanic >= 25.12.0, < 25.12.1Patched in:
sanic 24.12.1sanic 25.12.1Source: https://github.com/advisories/GHSA-wmj6-g64g-j7q5
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85077High· 8.2Sanic is an opensource python web server/framework
CVE-2022-35920High· 8.3sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2023-54397High· 7.5Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters
CVE-2024-14029High· 7.5Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request
CVE-2026-48746Critical· 9.1vLLM is an inference and serving engine for large language models (LLMs)