CVE-2026-42545CWE-248CWE-755

Granian: DoS via WSGI response header panic

Medium · published May 12, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.3th percentile
Weaknesses
CWE-248 · Uncaught Exception; CWE-755 · Improper Handling of Exceptional Conditions
Published
2026-05-12T21:51Z
EPSS history
Timeline
  • 12 MAY 21:51Z
    Granian: DoS via WSGI response header panic
    cvelistv5