Executive brief
Granian is a high-performance web server used to run Python applications. A vulnerability exists where the server fails to properly handle invalid data generated by the application it is hosting, such as malformed headers. If an attacker can trigger a response containing these invalid characters, the server process will crash, leading to a denial of service for the application.
Technical details
Granian (versions 0.2.0 through 2.7.4) improperly handles WSGI response headers by using the Rust `.unwrap()` method on header name and value constructors in `src/wsgi/io.rs`. If a WSGI application returns a header containing invalid characters (such as spaces in names, or null bytes and CRLF sequences in values), the resulting panic causes the worker process to abort rather than returning a standard 500 error. An attacker can exploit this if they can influence the output of the hosted Python application to include such malformed headers. The issue is fixed in version 2.7.4 by implementing proper error handling instead of process-terminating panics.
Affected products
- emmett-framework Granian 0.2.0 to 2.7.4
Timeline
- 2026-04-28: advisory: Vendor advisory published on GitHub
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fixed in version 2.7.4