CVE-2026-42544
High
Description
Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.
SeverityHigh
CVSS7.5
Exploit probability—
ProductGranian
PublishedMay 12, 2026
First seenMay 12, 2026
How to fix
Update
- granian2.7.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| granianPyPI | 1.2.0 ≤ v < 2.7.4 | 2.7.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.