CVE-2026-85077: Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can therefore emit injected headers and may split responses. Depending on application and proxy behavior, this can enable session fixation through injected cookies, cache poisoning, or security-header corruption. This issue is fixed in versions 24.12.1 and 25.12.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sanicto a version that resolves this vulnerability.Fixed in 24.12.1 - Upgrade
Upgrade
sanicto a version that resolves this vulnerability.Fixed in 25.12.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Sanic applications using HTTP/1.1 responses are affected if they run a version before 24.12.1 or version 25.12.0. Exposure is especially relevant where attacker-controlled input can reach response headers, download filenames, or cookie path or domain attributes.
What does an attacker need to exploit it?
An attacker needs a way to supply carriage-return or line-feed characters in data that the application places into response.headers, file(..., filename=...), or cookie path or domain attributes. No authentication or user interaction is required according to the supplied severity vector.
Are default applications necessarily vulnerable?
The affected HTTP/1.1 response pipeline does not reject CR/LF characters, but exploitation depends on the application passing attacker-controlled data into the affected response fields. The provided information does not establish that every default Sanic application exposes such input paths.
What should be done if upgrading cannot happen immediately?
Ensure untrusted data cannot be used in response header names or values, file response filenames, or cookie path and domain attributes, and reject or remove carriage-return and line-feed characters from those values. Upgrade to Sanic 24.12.1 or 25.12.1 when possible.
How can teams determine whether they are affected?
Check whether the application serves HTTP/1.1 responses on a Sanic version before 24.12.1 or exactly 25.12.0. Review response construction for untrusted data reaching response.headers, file(..., filename=...), and cookie path or domain settings.