CVE-2026-42544

Granian: Unauthenticated DoS via WebSocket subprotocol header panic

State: Published
Severity: 7.5 High
Published: May 12, 2026
Updated: May 18, 2026
Reserved: Apr 28, 2026

Description

Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-248 Uncaught Exception
CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
granianemmett-framework	>= 1.2.0, < 2.7.4Affected

References

https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.