CVE-2026-42544 PUBLISHED

Granian: Unauthenticated DoS via WebSocket subprotocol header panic

Assigner: GitHub_M
Reserved: 28.04.2026 Published: 12.05.2026 Updated: 12.05.2026

Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	emmett-framework
Product	granian
Versions	Version >= 1.2.0, < 2.7.4 is affected

References

https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6

Problem Types

CWE-20: Improper Input Validation CWE
CWE-248: Uncaught Exception CWE
CWE-400: Uncontrolled Resource Consumption CWE