Executive brief
Granian, a high-performance web server for Python applications, is vulnerable to a denial-of-service attack. An unauthenticated attacker can crash the server's worker processes by sending a specially crafted WebSocket request. If an attacker repeats this process, they can take the entire application offline, disrupting service for all users.
Technical details
A denial-of-service vulnerability exists in Granian's ASGI WebSocket scope construction path. The root cause is an unhandled 'unwrap()' on a Result type in 'src/asgi/utils.rs' when processing the 'Sec-WebSocket-Protocol' header. If a client sends a request containing non-ASCII bytes in this header, the 'HeaderValue::to_str()' method returns an error, triggering a panic. Because Granian is compiled with 'panic = "abort"', the panic terminates the entire worker process. An unauthenticated remote attacker can exploit this by sending a single crafted HTTP GET request with WebSocket upgrade headers, leading to a process crash before the application logic is even reached. This issue is fixed in version 2.7.4.
Affected products
- emmett-framework Granian >= 1.2.0, < 2.7.4
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published by maintainers
- 2026-05-12: disclosed: CVE-2026-42544 published to NVD
- 2026-05-12: patched: Vulnerability fixed in version 2.7.4