CVE-2026-42545: Granian: DoS via WSGI response header panic

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-12 · updated 2026-10-26
Weakness: CWE-248

Description

Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.

Affected products

emmett-framework granian: from 0.2.0, < 2.7.4

References

https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj
https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj

Get alerted when CVE-2026-42545 or the next vulnerability affects your stack