sanic chunked trailer request smuggling allows hidden second request execution

DescriptionSanic's HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating 0\r\n chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same...

PYSEC-2026-4162 sanic chunked trailer request smuggling allows hidden second request execution

Description Sanic's HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating 0\r\n chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same...

rsanic (>=0.1.1, <=0.4.0) potentially affected by CVE-2026-85078 via sanic (0.3.1)

sanic PYPI version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - rsanic =0.1.1, =0.4.0 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

sanic-cors (>=0.4.1, <=0.4.1.4) potentially affected by CVE-2026-85078 via sanic (0.4.1)

sanic PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - sanic-cors =0.4.1, =0.4.1.4 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

sanic-dispatcher (>=0.5.0, <=0.5.0.1) potentially affected by CVE-2026-85078 via sanic (0.5.0)

sanic PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - sanic-dispatcher =0.5.0, =0.5.0.1 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

sanic-cors (0.5.1.0), sanic-dispatcher (0.5.1.0) potentially affected by CVE-2026-85078 via sanic (0.5.1)

sanic PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - sanic-cors 0.5.1.0 - sanic-dispatcher 0.5.1.0 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

sanic-dispatcher (>=0.5.2.0, <=0.5.2.1) potentially affected by CVE-2026-85078 via sanic (0.5.2)

sanic PYPI version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - sanic-dispatcher =0.5.2.0, =0.5.2.1 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

ethereumd-proxy (>=0.1.2, <=0.3.0), rsanic (>=0.4.2, <=0.4.4) +2 more potentially affected by CVE-2026-85078 via sanic (0.5.4)

sanic PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - ethereumd-proxy =0.1.2, =0.4.2, =0.5.4.1, =0.5.4.1, =0.5.4.4 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

allennlp (>=0.1.0a6, <=0.3.0), datasette (>=0.8.0, <=0.13.0) +1 more potentially affected by CVE-2026-85078 via sanic (0.6.0)

sanic PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - allennlp =0.1.0a6, =0.8.0, =0.6.0.0, =0.6.0.1 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

datasette (>=0.14.0, <=0.28.0), datasette-core (0.22.1) +13 more potentially affected by CVE-2026-85078 via sanic (0.7.0)

sanic PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - datasette =0.14.0, =0.1.0, =1.0.3, =0.8.8, =0.1.0, =0.4.3, =0.1.5, =1.1.4 - slashcommands 0.4.0 - turingnetwork 0.1.1 Source cves: CVE-2026-85078 Sour...

postile (>=0.1.0, <=0.1.1), scylla (1.1.5) potentially affected by CVE-2026-85078 via sanic (0.8.1)

sanic PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - postile =0.1.0, =0.1.1 - scylla 1.1.5 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

entrance (>=0.0.1, <=0.0.5), eventy (>=2.1.1, <=2.5.0) +5 more potentially affected by CVE-2026-85078 via sanic (0.8.3)

sanic PYPI version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - entrance =0.0.1, =2.1.1, =0.2.0, =0.0.0, =0.1.0, =0.2.0 - swarmer 0.3.0 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

aclients (>=1.0.0b31, <=1.0.1b1), iconrpcserver (>=1.2.10, <=1.4.9) +12 more potentially affected by CVE-2026-85078 via sanic (18.12.0)

sanic PYPI version 18.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - aclients =1.0.0b31, =1.2.10, =0.1.0, =0.1.0, =0.24.0, =0.14.0a8, =0.0.0.post2, =0.0.1, =2.0.0, =0.1.0, =0.2.2 Source cves: CVE-2026-85078 Source...

aiocqhttp-sanic (>=1.2.3a1, <=1.2.3), ax (>=0.39.0, <=0.42.0) +11 more potentially affected by CVE-2026-85078 via sanic (19.3.1)

sanic PYPI version 19.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - aiocqhttp-sanic =1.2.3a1, =0.39.0, =1.4.2rc1, =1.0.0rc1, =0.1.0a1, =0.3.0, =0.1.0, =0.3.0, =0.7.0 Source cves: CVE-2026-85078 Source advisory:...

ax (>=0.43.0, <=0.52.0), convo-nlu (0.1.0) +17 more potentially affected by CVE-2026-85078 via sanic (19.12.2)

sanic PYPI version 19.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - ax =0.43.0, =0.0.4, =0.0.1, =0.1.3, =2024.10.27.post1, =0.23.5, =1.5.0, =0.1.0, =2.6.1, =3.10.2rc3 and more Source cves: CVE-2026-85078 Source...

auditorium (>=0.6.1, <=19.1.1), gino-admin (>=0.0.1, <=0.2.1) +9 more potentially affected by CVE-2026-85078 via sanic (19.12.5)

sanic PYPI version 19.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - auditorium =0.6.1, =0.0.1, =1.5.0, =1.4.0, =1.5.0, =0.0.2, =0.1.0, =0.1.2, =1.7.0, =0.1.0, =0.2.0 Source cves: CVE-2026-85078 Source advisory:...

cvapirisk (>=1.2.8, <=1.2.12), impsparc (>=1.2.12, <=3.2.4) potentially affected by CVE-2026-85078 via sanic (20.3.0)

sanic PYPI version 20.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - cvapirisk =1.2.8, =1.2.12, =3.2.4 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

discodo (>=0.0.2a0, <=1.0.5), klldfn (>=1.0.1, <=1.1.7) +3 more potentially affected by CVE-2026-85078 via sanic (20.6.3)

sanic PYPI version 20.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - discodo =0.0.2a0, =1.0.1, =1.1.7 - klldfnarabic 1.0.1 - pyreact2 0.0.4 - sanic-utils 0.1.1 Source cves: CVE-2026-85078 Source advisory:...

askbob (>=0.0.3, <=0.0.4), cde (0.2.0.1) +12 more potentially affected by CVE-2026-85078 via sanic (20.9.0)

sanic PYPI version 20.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - askbob =0.0.3, =0.0.19, =0.1.1, =0.3.26, =0.10.25, =2.2.10, =0.0.1, =0.2.1, =0.2.2 - sanic-sockjs 0.1.0 - sstool-general 0.0.4 - vma-nlu 1.1.6 Source...

apartment-browser (0.0.1), docsvault (>=0.1.2, <=0.1.4) +12 more potentially affected by CVE-2026-85078 via sanic (20.9.1)

sanic PYPI version 20.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - apartment-browser 0.0.1 - docsvault =0.1.2, =4.1.0, =0.2.2, =0.1.2, =2.8.7, =0.1.1, =0.0.4, =0.0.6 - sanic-oauthlib 0.2.3 - zillionare-omega 0.6.0...