Junglewise Threat Intelligence

CVE-2026-42544: Granian denial of service via WebSocket header panic

CVE-2026-42544 · Severity: high · CVSS 7.5 · Published 2026-05-12

Vendors: PyPI.

Executive brief

Granian, a high-performance web server for Python applications, is vulnerable to a denial-of-service attack. An unauthenticated attacker can crash the server's worker processes by sending a specially crafted WebSocket request. If an attacker repeats this process, they can take the entire application offline, disrupting service for all users.

Technical details

A denial-of-service vulnerability exists in Granian's ASGI WebSocket scope construction path. The root cause is an unhandled 'unwrap()' on a Result type in 'src/asgi/utils.rs' when processing the 'Sec-WebSocket-Protocol' header. If a client sends a request containing non-ASCII bytes in this header, the 'HeaderValue::to_str()' method returns an error, triggering a panic. Because Granian is compiled with 'panic = "abort"', the panic terminates the entire worker process. An unauthenticated remote attacker can exploit this by sending a single crafted HTTP GET request with WebSocket upgrade headers, leading to a process crash before the application logic is even reached. This issue is fixed in version 2.7.4.

Affected products

  • emmett-framework Granian >= 1.2.0, < 2.7.4

Timeline

  • 2026-04-28: advisory: GitHub Security Advisory published by maintainers
  • 2026-05-12: disclosed: CVE-2026-42544 published to NVD
  • 2026-05-12: patched: Vulnerability fixed in version 2.7.4

References

Related threats