Granian

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:emmett-framework:granian:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorEmmett Framework (194ac296-6989-50aa-a001-4074363bef8b)
ProductGranian (92bb39f7-2c72-5b65-be1c-f0392e5bfbde)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-42545 vulnerable 2026-06-08 08:03:16.482821 Granian: DoS via WSGI response header panic
MEDIUM (5.9)
Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.
Published: 2026-05-12T21:51:47.473Z
Updated: 2026-05-14T12:35:27.130Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-42544 vulnerable 2026-06-08 08:03:16.482509 Granian: Unauthenticated DoS via WebSocket subprotocol header panic
HIGH (7.5)
Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.
Published: 2026-05-12T21:46:19.734Z
Updated: 2026-05-18T15:09:40.421Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.