https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 18 Sep 2026 21:10:14 +0000 https://vulnerability.circl.lu/sighting/328469e0-4532-4476-82e3-5b4c31125249/export {"uuid": "328469e0-4532-4476-82e3-5b4c31125249", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85078", "type": "published-proof-of-concept", "source": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5", "content": "", "creation_timestamp": "2026-09-17T16:35:02.528825Z"} {"uuid": "328469e0-4532-4476-82e3-5b4c31125249", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85078", "type": "published-proof-of-concept", "source": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5", "content": "", "creation_timestamp": "2026-09-17T16:35:02.528825Z"} https://vulnerability.circl.lu/sighting/328469e0-4532-4476-82e3-5b4c31125249/export Thu, 17 Sep 2026 16:35:02 +0000 https://vulnerability.circl.lu/sighting/43801022-b108-4d00-9585-19f2c94da40e/export {"uuid": "43801022-b108-4d00-9585-19f2c94da40e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85078", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6p7udq5snpnfu", "content": "CVE-2026-85078 - sanic chunked trailer request smuggling allows hidden second request execution\nCVE ID : CVE-2026-85078\n \n Published : Sept. 17, 2026, 2:28 p.m. | 6\u00a0minutes ago\n \n Description : Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's cor...", "creation_timestamp": "2026-09-17T16:28:20.199573Z"} {"uuid": "43801022-b108-4d00-9585-19f2c94da40e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85078", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6p7udq5snpnfu", "content": "CVE-2026-85078 - sanic chunked trailer request smuggling allows hidden second request execution\nCVE ID : CVE-2026-85078\n \n Published : Sept. 17, 2026, 2:28 p.m. | 6\u00a0minutes ago\n \n Description : Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's cor...", "creation_timestamp": "2026-09-17T16:28:20.199573Z"} https://vulnerability.circl.lu/sighting/43801022-b108-4d00-9585-19f2c94da40e/export Thu, 17 Sep 2026 16:28:20 +0000 https://vulnerability.circl.lu/sighting/84315266-8621-433e-8a51-077d95dc6364/export {"uuid": "84315266-8621-433e-8a51-077d95dc6364", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85078", "type": "seen", "source": "https://gist.github.com/alon710/0ec5568a7a1b950531d7e3c938789029", "content": "# CVE-2026-85078: CVE-2026-85078: HTTP Request Smuggling via Chunked Trailers in Sanic Core HTTP Parser\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85078\n\n## Summary\nCVE-2026-85078 describes a critical request-boundary integrity vulnerability (HTTP Request Smuggling) in Sanic, an open-source high-performance Python web server and framework. The vulnerability exists within Sanic's core HTTP/1.1 chunked-body parser. Prior to the patched versions, when processing a chunked transfer-encoded request, Sanic's parser failed to fully consume or validate the trailer-part following the terminating zero-size chunk.\n\n## TL;DR\nSanic's HTTP/1.1 chunked parser fails to process or reject trailing headers after a zero-size chunk. Attackers can leverage this on keep-alive connections to smuggle subsequent HTTP requests, bypassing proxy security filters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.5\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not Listed\n- **Remediation**: Upgrade to Sanic 24.12.1 / 25.12.1\n\n## Affected Systems\n\n- Sanic < 24.12.1\n- Sanic 25.12.0\n- **sanic**: < 24.12.1 (Fixed in: `24.12.1`)\n- **sanic**: == 25.12.0 (Fixed in: `25.12.1`)\n\n## Mitigation\n\n- Upgrade Sanic web server to patched versions.\n- Configure intermediate proxies to strip HTTP trailers.\n- Implement robust request body buffering on Nginx or HAProxy.\n\n**Remediation Steps:**\n1. Identify all deployment environments running Sanic web server.\n2. For deployments on v24 LTS, upgrade Sanic package to at least version 24.12.1.\n3. For deployments on v25 LTS, upgrade Sanic package to at least version 25.12.1.\n4. Verify the update by issuing a chunked HTTP request containing trailers and checking if the server drops the connection.\n\n## References\n\n- [GitHub Security Advisory GHSA-wmj6-g64g-j7q5](https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5)\n- [CVE Registry Entry for CVE-2026-85078](https://www.cve.org/CVERecord?id=CVE-2026-85078)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85078) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T15:31:49.745031Z"} {"uuid": "84315266-8621-433e-8a51-077d95dc6364", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85078", "type": "seen", "source": "https://gist.github.com/alon710/0ec5568a7a1b950531d7e3c938789029", "content": "# CVE-2026-85078: CVE-2026-85078: HTTP Request Smuggling via Chunked Trailers in Sanic Core HTTP Parser\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85078\n\n## Summary\nCVE-2026-85078 describes a critical request-boundary integrity vulnerability (HTTP Request Smuggling) in Sanic, an open-source high-performance Python web server and framework. The vulnerability exists within Sanic's core HTTP/1.1 chunked-body parser. Prior to the patched versions, when processing a chunked transfer-encoded request, Sanic's parser failed to fully consume or validate the trailer-part following the terminating zero-size chunk.\n\n## TL;DR\nSanic's HTTP/1.1 chunked parser fails to process or reject trailing headers after a zero-size chunk. Attackers can leverage this on keep-alive connections to smuggle subsequent HTTP requests, bypassing proxy security filters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.5\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not Listed\n- **Remediation**: Upgrade to Sanic 24.12.1 / 25.12.1\n\n## Affected Systems\n\n- Sanic < 24.12.1\n- Sanic 25.12.0\n- **sanic**: < 24.12.1 (Fixed in: `24.12.1`)\n- **sanic**: == 25.12.0 (Fixed in: `25.12.1`)\n\n## Mitigation\n\n- Upgrade Sanic web server to patched versions.\n- Configure intermediate proxies to strip HTTP trailers.\n- Implement robust request body buffering on Nginx or HAProxy.\n\n**Remediation Steps:**\n1. Identify all deployment environments running Sanic web server.\n2. For deployments on v24 LTS, upgrade Sanic package to at least version 24.12.1.\n3. For deployments on v25 LTS, upgrade Sanic package to at least version 25.12.1.\n4. Verify the update by issuing a chunked HTTP request containing trailers and checking if the server drops the connection.\n\n## References\n\n- [GitHub Security Advisory GHSA-wmj6-g64g-j7q5](https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5)\n- [CVE Registry Entry for CVE-2026-85078](https://www.cve.org/CVERecord?id=CVE-2026-85078)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85078) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T15:31:49.745031Z"} https://vulnerability.circl.lu/sighting/84315266-8621-433e-8a51-077d95dc6364/export Thu, 17 Sep 2026 15:31:49 +0000