https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 08:55:31 +0000 https://cve.radiocsirt.org/vuln/cve-2026-85078 <p><strong>Affected:</strong> sanic-org sanic</p> <p>Sanic is an opensource python web server/framework. In version 25.12.0, Sanic&#39;s core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.</p> <p><strong>Affected:</strong> sanic-org sanic</p> <p>Sanic is an opensource python web server/framework. In version 25.12.0, Sanic&#39;s core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-85078 https://cve.radiocsirt.org/vuln/ghsa-wmj6-g64g-j7q5 <p><strong>Affected:</strong> PyPI: sanic</p> <p>## Description</p> <p>Sanic&#39;s HTTP/1.1 chunked-body handling does not fully consume the `trailer-part` after the terminating `0\r\n` chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same keep-alive connection. In the attached verified proof, a single outer `POST /` request that correctly returns `405 Method Not Allowed` is followed, within the same TCP send, by a hidden second request smuggled through the chunked trailer area. Sanic parses and executes that second request as a real independent request.</p> <p>The issue is a request-boundary integrity failure in Sanic&#39;s core HTTP/1.1 parser. The verified impact is not speculative. The attached proof shows that one TCP payload produces two server responses: first the expected `405` for the outer `POST /`, then a separate `200 OK` for a hidden `GET /`. A second exploit variant changes the hidden request path and receives a real `404 Not Found`, proving that the hidden second request is not a hard-coded artifact but an actually routed backend request. A control case with a two-character trailer field name shifts the leftover bytes from `GET` to `:GET`, which changes the second response accordingly and confirms that the root cause is incorrect trailer consumption rather than legitimate pipelining.</p> <p>## Steps To Reproduce</p> <p>1. Start a Sanic HTTP/1.1 service on a keep-alive connection path. In the verified run, the local ta…</p> <p><strong>Affected:</strong> PyPI: sanic</p> <p>## Description</p> <p>Sanic&#39;s HTTP/1.1 chunked-body handling does not fully consume the `trailer-part` after the terminating `0\r\n` chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same keep-alive connection. In the attached verified proof, a single outer `POST /` request that correctly returns `405 Method Not Allowed` is followed, within the same TCP send, by a hidden second request smuggled through the chunked trailer area. Sanic parses and executes that second request as a real independent request.</p> <p>The issue is a request-boundary integrity failure in Sanic&#39;s core HTTP/1.1 parser. The verified impact is not speculative. The attached proof shows that one TCP payload produces two server responses: first the expected `405` for the outer `POST /`, then a separate `200 OK` for a hidden `GET /`. A second exploit variant changes the hidden request path and receives a real `404 Not Found`, proving that the hidden second request is not a hard-coded artifact but an actually routed backend request. A control case with a two-character trailer field name shifts the leftover bytes from `GET` to `:GET`, which changes the second response accordingly and confirms that the root cause is incorrect trailer consumption rather than legitimate pipelining.</p> <p>## Steps To Reproduce</p> <p>1. Start a Sanic HTTP/1.1 service on a keep-alive connection path. In the verified run, the local ta…</p> https://cve.radiocsirt.org/vuln/ghsa-wmj6-g64g-j7q5