CVE-2026-42544

High

Published: 12/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Granian is a Rust HTTP server for Python applications. From versions 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes.

Risk Assessment

An attacker could cause the server to crash, leading to application unavailability. This may affect the continuity of services within the organization.

Recommendation

It is recommended to update Granian to version 2.7.4 or later to mitigate this vulnerability.

Other vulnerabilities in Granian HTTP server

CVE-2026-42545Medium
Granian is a Rust HTTP server for Python applications. From versions 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value.

Original NVD description (English source)

Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.