Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Sanic's HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating 0\r\n chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same keep-alive connection. In the attached verified proof, a single outer POST / request that correctly returns 405 Method Not Allowed is followed, within the same TCP send, by a hidden second request smuggled through the chunked trailer area. Sanic parses and executes that second request as a real independent request. The issue is a request-boundary integrity failure in Sanic's core HTTP/1.1 parser. The verified impact is not speculative. The attached proof shows that one TCP payload produces two server responses: first the expected 405 for the outer POST /, then a separate 200 OK for a hidden GET /. A second exploit variant changes the hidden request path and receives a real 404 Not Found,…
Recommended action: Upgrade to 25.12.1 or 24.12.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Patches - v20.12.7 (LTS) - v21.12.2 (LTS) - v22.6.1 References https://github.com/sanic-org/sanic/issues/2478 https://github.com/sanic-org/sanic/pull/2495 For more information If you have any questions or comments about this advisory: Open an issue in the community forums Ping us on the Discord server
Recommended action: Upgrade to 22.6.1, 21.12.2 or 20.12.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.
Recommended action: Upgrade to 0.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
!!! ONLY APPLIES TO VERSIONS PRIOR TO Sanic v20.12 WHEN USING Python 3.10 !!! Sanic v20.12 officially supports Python versions 3.6, 3.7, 3.8, and 3.9. However, if you accidentally run it with version 3.10 (which is not supported by Sanic 20.12), your server is prone to crashing on an incoming web request. Impact Anyone running Sanic server between 0.1.7 and 20.12 using Python 3.10. Patches Sanic v20.12.6 Workarounds Use a supported version of Python (v3.6 - v3.9) References In asyncio, the explicit passing of a loop argument has been deprecated and will be removed in version 3.10 for the following: ... asyncio.Event Python 3.8 Release Notes For more information If you have any questions or comments about this advisory: Open an issue in the community forums Ping us on the Discord server
Recommended action: Upgrade to 20.12.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.