Sanic versions before 24.12.1 and version 25.12.0 improperly serialize HTTP/1.1 response headers without rejecting carriage-return or line-feed characters in header names and values. This allows attacker-controlled data placed in response headers, file attachment filenames, or cookie path and domain attributes to inject headers and split HTTP responses. Such response splitting can enable session fixation via injected cookies, cache poisoning, or corruption of security headers. The vulnerability is addressed in Sanic versions 24.12.1 and 25.12.1.

An attacker can exploit this vulnerability to inject arbitrary HTTP headers and split HTTP responses. This may result in session fixation attacks through injected cookies, cache poisoning, or manipulation of security headers, potentially compromising user sessions and application security. The CVSS score of 8.2 (high) reflects the significant impact on confidentiality and integrity without requiring privileges or user interaction.

Upgrade Sanic to version 24.12.1 or later, or to version 25.12.1 or later. These versions include fixes that properly sanitize CRLF characters in HTTP headers, preventing response splitting. No other mitigation is required as the issue is fixed in these versions.