CVE-2026-42545

Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj
https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Granian es un servidor HTTP de Rust para aplicaciones Python. Desde la versión 0.2.0 hasta la 2.7.4, Granian aborta un proceso de trabajador si una aplicación WSGI devuelve un nombre o valor de encabezado de respuesta HTTP no válido. La ruta de conversión de respuesta WSGI utiliza .unwrap() tanto en los constructores de nombre de encabezado como de valor de encabezado, por lo que una salida mal formada de la aplicación se convierte en una interrupción del proceso en lugar de un error manejado. Esta vulnerabilidad se corrige en la versión 2.7.4.

Information

Published : 2026-05-12 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-42545

Mitre link : CVE-2026-42545

CVE.ORG link : CVE-2026-42545

JSON object : View

Products Affected

No product.

CWE

CWE-248

Uncaught Exception

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2026-42545", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42545", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T12:35:15.328399Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "emmett-framework", "product": "granian", "versions": [{"status": "affected", "version": ">= 0.2.0, < 2.7.4"}]}]}], "published": "2026-05-12T22:16:34.600", "references": [{"url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj", "source": "security-advisories@github.com"}, {"url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-248"}, {"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4."}, {"lang": "es", "value": "Granian es un servidor HTTP de Rust para aplicaciones Python. Desde la versi\u00f3n 0.2.0 hasta la 2.7.4, Granian aborta un proceso de trabajador si una aplicaci\u00f3n WSGI devuelve un nombre o valor de encabezado de respuesta HTTP no v\u00e1lido. La ruta de conversi\u00f3n de respuesta WSGI utiliza .unwrap() tanto en los constructores de nombre de encabezado como de valor de encabezado, por lo que una salida mal formada de la aplicaci\u00f3n se convierte en una interrupci\u00f3n del proceso en lugar de un error manejado. Esta vulnerabilidad se corrige en la versi\u00f3n 2.7.4."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}