Emmett-framework Granian vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Emmett-framework Granian: 2 record(s), with affected versions and fixes.
CVE-2026-42545
Medium · 5.9
CWE-248 May 12, 2026
Granian: DoS via WSGI response header panic
Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.
CVE-2026-42544
High · 7.5
CWE-20 May 12, 2026
Granian: Unauthenticated DoS via WebSocket subprotocol header panic
Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.