Sanic versions 25.12.0 and versions prior to 24.12.1 improperly handle the trailer part of HTTP/1.1 chunked requests by not fully consuming it before reusing the keep-alive connection buffer. This flaw allows a remote unauthenticated attacker to insert attacker-controlled bytes into the trailer region, which Sanic parses as a second hidden HTTP request. This breaks the integrity of HTTP request boundaries and can be exploited for HTTP request smuggling attacks, particularly when Sanic is used behind intermediaries such as proxies or load balancers. The vulnerability is identified as CWE-444 (Inconsistent Interpretation of HTTP Requests). The vendor fixed this issue in Sanic version 25.12.1.

The vulnerability allows an unauthenticated remote attacker to perform HTTP request smuggling by injecting a hidden second request within the trailer part of a chunked HTTP request. This can lead to request boundary confusion, potentially allowing attackers to bypass security controls, poison caches, or perform other attacks that rely on manipulating HTTP request parsing. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

A fix is available in Sanic version 25.12.1. Users should upgrade affected Sanic installations to version 25.12.1 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.