CVE-2026-42544 Granian: Unauthenticated DoS via WebSocket subprotocol header panic
Unauthenticated attackers can crash Granian worker processes by sending WebSocket requests with non-ASCII subprotocol headers, causing service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42544?
CVE-2026-42544 is a high-severity denial of service vulnerability in emmett-framework granian, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.
Which versions are affected by CVE-2026-42544?
3 open source packages ship an affected version, including granian.
| Package | Affected | Fixed in |
|---|---|---|
granian PyPI | From 1.2.0 | 2.7.4 |
granian PyPI | From 1.2.0 | 2.7.4 |
granian PyPI | From 1.2.0 | 2.7.4 |
How do I fix CVE-2026-42544?
Upgrade granian to 2.7.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-42544 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42544 exists.
Sources
Also known as ECHO-14ce-5047-a43f, GHSA-vrg7-482j-p6f6, MINI-rmqh-xwrw-h2ff, PYSEC-2026-2503.