CVE-2026-42545

Published: May 12, 2026Modified: Jun 17, 2026Deferred

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.

Related CWEs

CWE-248

Uncaught Exception

An exception is thrown from a function, but it is not caught.

CWE-755

Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

References (2)

https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj

Source: security-advisories@github.com

https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.