Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sanic | pip | < 24.12.1 | 24.12.1 |
| sanic | pip | >= 25.12.0, < 25.12.1 | 25.12.1 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-85078, describes a request smuggling issue in Sanic's HTTP/1.1 chunked-body handling. The core problem is that the trailer-part of a chunked request was not fully consumed after the terminating 0\r\n chunk, allowing attacker-controlled bytes to remain in the connection buffer and be interpreted as a new HTTP request on the same keep-alive connection.
Analysis of the provided commit 69a10d3b06babaa9e5f6d1af577364e9e53b6dea (and its inclusion in the LTS patches 47349d689d65fa1907977ac100e867894aeafb22 and a332796506c7c588b6930b02a8886e43eb8ea8d6) clearly points to modifications within the sanic/http/http1.py file, specifically within the read method of the Http1 class. This method is responsible for reading and parsing the HTTP request body, including chunked data and trailers.
The patch removes code that inadequately consumed the end of the chunked body and introduces new logic to explicitly check for and reject any non-empty trailer-part. If a non-empty trailer is detected, a BadRequest exception is raised, and the connection is closed (self.keep_alive = False), preventing the smuggled request from being processed. This direct modification to the chunked body parsing logic confirms Http1.read as the vulnerable function responsible for the improper handling of the trailer-part that led to request smuggling.
Http1.readsanic/http/http1.py