Summary
CVE-2026-85077 is a high-severity HTTP response header/CRLF injection vulnerability in the Sanic Python web framework. Sanic’s HTTP/1.1 response pipeline fails to validate carriage-return (r) and line-feed (n) characters when serializing response headers, filename parameters in file responses, and cookie attributes such as path and domain. When an application reflects attacker-controlled input into any of these fields, an attacker can inject arbitrary headers into the HTTP response, enabling response splitting, session fixation via forged Set-Cookie headers, cache poisoning, or corruption of security headers.
Technical details
- Root cause: Sanic does not sanitize or reject CR/LF characters when encoding HTTP response headers, file-response filename parameters, or cookie attribute values (path, domain) before writing them onto the wire.
- Trigger conditions: An application built on the vulnerable Sanic version reflects untrusted, attacker-supplied data (e.g., query parameters, headers, or other user input) into a response header value, a downloaded file’s filename, or a cookie attribute, without the framework enforcing CRLF filtering.
- Attack vector: Network-based, unauthenticated, low complexity, no user interaction required (CVSS AV:N/AC:L/PR:N/UI:N). A remote attacker sends a crafted request containing URL-encoded CRLF sequences (e.g.,
%0d%0a) in a parameter that the application echoes back into a response header. - Impact: Injection of arbitrary additional HTTP response headers (including forged
Set-Cookieheaders), leading to session fixation, HTTP response splitting, cache poisoning at intermediary caches/CDNs, and corruption or bypass of security-relevant response headers. The vulnerability affects integrity (I:H) with limited confidentiality impact (C:L) and no availability impact (A:N).
Affected software
- Sanic (sanic-org/sanic), all versions prior to 24.12.1
- Sanic version 25.12.0 specifically (prior to the 25.12.1 fix)
Severity
- CVSS v3.1 Base Score: 8.2 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)
Mitigation and recommended actions
- Immediate: Upgrade Sanic to a patched release — 24.12.1 (for the 24.x line) or 25.12.1 (for the 25.x line), both of which sanitize CR/LF characters in response header encoding, file-response filenames, and cookie attributes.
- If patching is not immediately possible:
- Audit application code for any place where user-controlled input is written into response headers, file download filenames, or cookie path/domain attributes, and strip or reject
r/ncharacters (including URL-encoded forms such as%0d/%0a) before use. - Deploy a web application firewall (WAF) or reverse proxy rule to block requests containing encoded CR/LF sequences targeting parameters known to be reflected in responses.
- Review caching layers and CDNs sitting in front of affected deployments for cache-poisoning exposure until the framework is upgraded.
- Audit application code for any place where user-controlled input is written into response headers, file download filenames, or cookie path/domain attributes, and strip or reject