Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🟠 Sanic, HTTP Request Smuggling via Chunked Trailer, #CVE-2026-85078 (Medium) -DC-Sep2026-2423 https://dailycve.com/sanic-http-request-smuggling-via-chunked-trailer-cve-2026-85078-medium-dc-sep2026-2423/
Post summary
The tweet announces CVE‑2026‑85078, describing an HTTP Request Smuggling flaw in Sanic via Chunked Trailer and links to a detailed article, with no PoC, exploit, patch, or active exploitation information provided.
CVE-2026-85078 Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the … https://www.cve.org/CVERecord?id=CVE-2026-85078
Post summary
The text discloses CVE-2026-85078 affecting Sanic 25.12.0, describing a technical vulnerability in HTTP/1.1 chunked-body trailer handling, but provides no PoC, exploit, active exploitation evidence, or remediation guidance.