PT-2026-38269 · Granian · Granian

Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-42545

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Granian versions 0.2.0 through 2.7.3

Description Granian aborts a worker process when a WSGI application returns an invalid HTTP response header name or value. This occurs because the WSGI response conversion path utilizes .unwrap() on both header name and header value constructors, causing malformed output to trigger a process abort rather than a handled error. This issue requires a buggy or attacker-influenced WSGI application to emit invalid headers, such as header names containing spaces or header values containing null bytes or r . Consequently, application errors that should result in a 500 error instead lead to a worker process denial of service.

Recommendations Update Granian to version 2.7.4.

Exploit

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-248

CWE-755

Related Identifiers

CVE-2026-42545

GHSA-F5P7-9FR5-8JMJ

Affected Products

Granian

References · 7

• 🔥 https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42545 · Security Note
• https://osv.dev/vulnerability/GHSA-f5p7-9fr5-8jmj · Vendor Advisory
• https://github.com/emmett-framework/granian · Note
• https://t.me/CVEtracker/53545 · Telegram Post
• https://twitter.com/CVEnew/status/2054340933378867616 · Twitter Post
• https://t.me/cveNotify/163443 · Telegram Post