PT-2026-38268 · Granian · Granian

Published 2026-05-06 · Updated 2026-05-12 · CVE-2026-42544

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Granian versions 1.2.0 through 2.7.3

Description An unauthenticated client can cause a worker process to abort by sending a WebSocket upgrade request containing non-ASCII bytes in the Sec-WebSocket-Protocol header. This occurs during the WebSocket scope construction path before the ASGI application is invoked. The issue is triggered when the HeaderValue::to str() function returns an error for bytes outside the visible ASCII range, and a subsequent .unwrap() call causes a panic. Because release builds are configured to abort on panic, this results in a denial of service where a single crafted request terminates one worker, and repeated requests can take the entire service offline.

Recommendations Update to version 2.7.4.

Exploit

Fix

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

CWE-248

Related Identifiers

CVE-2026-42544

GHSA-VRG7-482J-P6F6

Affected Products

Granian

References · 5

• 🔥 https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42544 · Security Note
• https://osv.dev/vulnerability/GHSA-vrg7-482j-p6f6 · Vendor Advisory
• https://github.com/emmett-framework/granian · Note
• https://twitter.com/CVEnew/status/2054340934444138824 · Twitter Post