CVE-2026-85077

Name of the Vulnerable Software and Affected Versions Sanic versions prior to 24.12.1 Sanic version 25.12.0

Description The HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. This allows applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes to emit injected headers and split responses. Depending on the application and proxy behavior, this can lead to session fixation through injected cookies, cache poisoning, or security-header corruption.

Recommendations Update to version 24.12.1 or later. Update to version 25.12.1 or later.