CVE-2026-85077

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85077
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85077.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85077
Aliases
  • GHSA-m64h-22vf-48wm
Published
2026-09-17T14:26:39Z
Modified
2026-09-19T03:47:23Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
Summary
Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
Details

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-113"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85077.json"
}
References

Affected packages

Git / github.com/sanic-org/sanic

Affected ranges

Type
GIT
Repo
https://github.com/sanic-org/sanic
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
785d77f8fe208576a48d339bd81d866021154092
Fixed
47349d689d65fa1907977ac100e867894aeafb22
Fixed
ef9240ce844472745fa213de216a37e188431fa6
Fixed
9a95bb1c187558949606b915f5162c15f2db781b
Fixed
a332796506c7c588b6930b02a8886e43eb8ea8d6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "24.12.1"
        },
        {
            "introduced": "25.12.0"
        },
        {
            "fixed": "25.12.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.0
0.3.0
0.3.1
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.6.0
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
18.*
18.12.0
19.*
19.03.1
19.3
v19.*
v19.12.1
v19.6.0
v19.6.1
v19.6.2
v19.6.3
v19.9.0
v20.*
v20.12.0
v20.3.0
v20.6.3
v20.9.0
v20.9.1
v21.*
v21.12.0
v21.3.0
v21.3.1
v21.3.2
v21.6.0
v21.9.0
v21.9.1
v22.*
v22.12.0
v22.3.0
v22.3.1
v22.6.0
v22.9.0
v22.9.1
v23.*
v23.3.0
v23.6.0
v24.*
v24.12.0
v25.*
v25.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85077.json"