CVE-2026-42544

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42544", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-28T16:56:50.191Z", "datePublished": "2026-05-12T21:46:19.734Z", "dateUpdated": "2026-05-18T15:09:40.421Z"}, "containers": {"cna": {"title": "Granian: Unauthenticated DoS via WebSocket subprotocol header panic", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6"}], "affected": [{"vendor": "emmett-framework", "product": "granian", "versions": [{"version": ">= 1.2.0, < 2.7.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T21:46:19.734Z"}, "descriptions": [{"lang": "en", "value": "Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4."}], "source": {"advisory": "GHSA-vrg7-482j-p6f6", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-18T15:09:10.114108Z", "id": "CVE-2026-42544", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T15:09:40.421Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42544", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T15:09:10.114108Z"}}}], "references": [{"url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T15:08:08.213Z"}}], "cna": {"title": "Granian: Unauthenticated DoS via WebSocket subprotocol header panic", "source": {"advisory": "GHSA-vrg7-482j-p6f6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "emmett-framework", "product": "granian", "versions": [{"status": "affected", "version": ">= 1.2.0, < 2.7.4"}]}], "references": [{"url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6", "name": "https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248: Uncaught Exception"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T21:46:19.734Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42544", "state": "PUBLISHED", "dateUpdated": "2026-05-18T15:09:40.421Z", "dateReserved": "2026-04-28T16:56:50.191Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T21:46:19.734Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "granian", "vendor": "emmett-framework", "versions": [{"status": "affected", "version": ">= 1.2.0, < 2.7.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4."}, {"lang": "es", "value": "Granian es un servidor HTTP de Rust para aplicaciones Python. Desde 1.2.0 hasta 2.7.4, Granian aborta un proceso de trabajador cuando un cliente no autenticado env\u00eda una solicitud de actualizaci\u00f3n de WebSocket cuyo encabezado Sec-WebSocket-Protocol contiene bytes no ASCII. El fallo ocurre en la ruta de construcci\u00f3n del \u00e1mbito de WebSocket de Granian, antes de que se invoque la aplicaci\u00f3n ASGI. Esta vulnerabilidad se corrige en 2.7.4."}], "id": "CVE-2026-42544", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42544", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-18T15:09:10.114108Z", "version": "2.0.3"}}]}, "published": "2026-05-12T22:16:34.467", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-vrg7-482j-p6f6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-248"}, {"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.2.0,2.7.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "granian", "vendor": "emmett-framework"}], "created": "2026-05-12T23:45:25.454027+00:00", "updated": "2026-05-13T10:35:22.178138+00:00", "vendors": ["emmett-framework", "emmett-framework$PRODUCT$granian"]}