Vulnerability details

CVE-2026-42544

emmett-framework granian

Granian: Unauthenticated DoS via WebSocket subprotocol header panic

CVSS 3.1

7.5High

Official description

Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
emmett-framework	granian	>= 1.2.0, < 2.7.4	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6 x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-05-13
Last updated: 2026-05-18
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.39%

Probability of exploitation in 30 days

33.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-20
Improper Input Validation
CWE-248
Uncaught Exception
CWE-400
Uncontrolled Resource Consumption