Sanic EUVD-2026-81626

Exploitation requires a Sanic application (prior to 24.12.1, or 25.12.0) that places attacker-controlled data into response.headers, into the filename argument of file(..., filename=...), or into cookie path/domain attributes - these are the concrete injection sinks Sanic fails to sanitize for CR/LF/NUL. The attacker needs no authentication or user interaction (PR:N/UI:N), but the vulnerability is inert unless such a reflection sink exists in application code; additionally, realized impact (response splitting vs. mere header injection) depends on intermediate proxy and cache behavior, which can limit or amplify the outcome.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, base 8.2) rates this high, driven by the network vector, low complexity, and no privileges/interaction for the attacker, with integrity as the dominant impact (I:H) - consistent with HTTP response splitting (CWE-113) enabling cache poisoning, session fixation via injected cookies, and security-header corruption. However, the raw score understates a key real-world gate: exploitability depends entirely on whether the deploying APPLICATION places attacker-controlled data into response.headers, file(..., filename=...), or cookie path/domain attributes - Sanic's flaw is the failure to strip CR/LF/NUL, but the injection sink must exist in application code. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no public exploit identified at time of analysis; this is a patch-and-prioritize framework hardening issue rather than evidence of active mass exploitation. Effective impact is also 'depending on application and proxy behavior' per the advisory, meaning downstream proxy normalization can blunt or amplify response splitting. Treat as a genuine high-priority library upgrade for any Sanic app that reflects user input into headers/cookies, but not an emergency drop-everything unless such a sink is confirmed.

An attacker submits input (e.g., a filename, redirect target, or cookie attribute) that a Sanic application echoes into a response header; because sanic/response/types.py serializes header names/values without rejecting CR/LF, the attacker embeds \r\n to inject a Set-Cookie header for session fixation or to split the response and poison a shared cache. No authentication or user interaction is required of the attacker, and no public exploit code is identified, though the injection technique is well-understood and trivially reproducible where a reflecting sink exists.