CVE-2026-85078: HTTP Request Smuggling via Chunked Trailers in Sanic Core HTTP Parser

CVE-2026-85078 is a critical request-boundary integrity vulnerability (HTTP Request Smuggling) in Sanic, an open-source, high-performance Python web server and framework. The flaw is located within Sanic's core HTTP/1.1 chunked-body parser. Prior to the patched versions, Sanic failed to validate or consume the trailer-part of a chunked request.

When deployed behind intermediaries such as reverse proxies, load balancers, or CDNs, this parser defect allows an unauthenticated remote attacker to append a malicious payload inside the trailer section of the persistent TCP connection stream. Because keep-alive is active on the backend socket, Sanic incorrectly reads the unconsumed trailer bytes from the buffer and parses them as a brand-new, independent, and smuggled HTTP request.

This behavior breaks request-boundary integrity and provides a powerful request-smuggling primitive. The vulnerability is classified under CWE-444, which designates inconsistent interpretation of HTTP requests.

Under RFC 9112 Section 7.1, chunked transfer encoding allows a sender to transfer a message body as a series of chunks. A chunked body terminates with a chunk of size zero (0\r\n), followed by an optional trailer-part consisting of zero or more header fields, and concluding with an empty line. In vulnerable versions of Sanic, the parser logic inside sanic/http/http1.py handled the termination of chunked bodies under the assumption that no trailers would ever be appended.

Specifically, the vulnerable code deleted a fixed offset of 4 bytes (pos += 4) upon finding the terminal zero chunk, which assumed the immediate presence of \r\n\r\n. If the client transmitted trailer fields, those trailers followed the 0\r\n line. Because the parser deleted only up to pos, any trailing headers or payload bytes sent after the 0\r\n remained entirely unconsumed inside the stream buffer.

Since the underlying TCP connection used Connection: keep-alive, Sanic recycled the connection buffer for the next request. The event loop immediately read the leftover, unconsumed trailer bytes from the socket buffer and interpreted them as the start of a new, pipelined HTTP request. This discrepancy allows attackers to inject arbitrary requests that bypass proxy filters.

The vulnerability was resolved by refactoring how the parser consumes and validates trailing data in sanic/http/http1.py. Rather than attempting to parse and store trailer headers, Sanic chooses the safest possible strategy: strictly rejecting any requests containing trailers and terminating the TCP connection immediately. This decision limits the attack surface without introducing complex parser state-machines.

Below is the comparison of the vulnerable and patched code blocks in sanic/http/http1.py under commit a332796506c7c588b6930b02a8886e43eb8ea8d6. The diff demonstrates how hardcoded offsets were replaced with explicit lookahead buffer checks. This ensures complete validation of trailing sequences before recycling the socket.

# Vulnerable Implementation
# Consume CRLF, chunk size 0 and the two CRLF that follow
pos += 4
# Might need to wait for the final CRLF
while len(buf) < pos:
    await self._receive_more()
del buf[:pos]

# Patched Implementation
# Consume the leading CRLF, the terminating size line and
# the CRLF that follows it.
del buf[: pos + 2]
 
# Only the empty line that ends the (empty) trailer section
# may follow. Wait for it to arrive.
while len(buf) < 2:
    await self._receive_more()
 
# Reject any trailer-part. Leaving trailer bytes in the
# buffer would let them be reparsed as a smuggled request on
# this keep-alive connection.
if buf[:2] != b"\r\n":
    self.keep_alive = False
    raise BadRequest("Bad chunked encoding")
 
# Consume the final empty line. Anything after it is a
# legitimately pipelined next request.
del buf[:2]

To exploit this vulnerability, an attacker must identify a Sanic server deployed behind an HTTP/1.1-compliant reverse proxy that forwards chunked requests verbatim or fails to strip trailers. The attacker crafts a request using Transfer-Encoding: chunked and specifies a persistent connection (Connection: keep-alive). Inside the HTTP request body, the attacker ends the chunked payload with 0\r\n and immediately appends a smuggled HTTP request starting in the trailer region.

The front-end proxy processes the incoming request. Since the proxy sees a single valid chunked POST request, it forwards the complete TCP payload to the Sanic backend. Sanic parses the first request, processes the chunks, and upon encountering the 0\r\n chunk, it deletes up to the hardcoded pos limit, considering the body fully read. It routes the first request to the application handler and returns a response.

The bytes after 0\r\n (representing the smuggled request) remain in Sanic's connection read buffer. Because Connection: keep-alive is enabled, Sanic returns to its read loop, detects bytes in the connection buffer, and parses them as a new incoming request. This smuggled request is processed directly by Sanic, bypassing any authentication checks or access controls configured at the proxy layer.

The concrete security impact of CVE-2026-85078 depends on the routing architecture and access controls configured on the front-end proxy. By smuggling an arbitrary request, an attacker can access administrative endpoints restricted at the proxy tier, bypass authentication controls, or retrieve sensitive metadata. If the proxy buffers and caches responses, the attacker can also perform web cache poisoning, associating a malicious response with a legitimate static asset.

The CVSS v3.1 base score is 6.5, with low impact on integrity and availability from a standalone perspective. However, when integrated into a complex infrastructure, the impact can escalate to unauthorized execution of administrative actions. The attack complexity is low, and no specialized privileges or user interactions are required.

Currently, the exploit status of this vulnerability is proof-of-concept. While no active exploitation in the wild has been cataloged by CISA, the simplicity of request-smuggling exploitation makes immediate mitigation crucial for internet-facing installations.

The primary remediation is to upgrade Sanic to a non-vulnerable version. If operating on the v24 LTS branch, upgrade to v24.12.1 or later. If operating on the v25 LTS branch, upgrade to v25.12.1 or later. These versions terminate keep-alive connections when unexpected trailers are detected.

If immediate upgrading is not possible, the threat can be mitigated at the front-end proxy tier. Ensure the reverse proxy is configured to strictly normalize incoming requests and reject chunked headers with trailers, or force the proxy to buffer the request body completely. For instance, in Nginx, maintain the default request body buffering configuration (proxy_request_buffering on) and avoid passing raw chunked streams unless necessary.

Additionally, implementing strict protocol compliance checks on intermediate load balancers can drop any request containing invalid or unexpected headers. Security teams should also monitor application logs for unexpected 405 Method Not Allowed or 400 Bad Request errors, which may indicate failed or experimental smuggling attempts.