CVE-2026-42545

{
  "id": "CVE-2026-42545",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T22:16:34.600",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4."
    },
    {
      "lang": "es",
      "value": "Granian es un servidor HTTP de Rust para aplicaciones Python. Desde la versión 0.2.0 hasta la 2.7.4, Granian aborta un proceso de trabajador si una aplicación WSGI devuelve un nombre o valor de encabezado de respuesta HTTP no válido. La ruta de conversión de respuesta WSGI utiliza .unwrap() tanto en los constructores de nombre de encabezado como de valor de encabezado, por lo que una salida mal formada de la aplicación se convierte en una interrupción del proceso en lugar de un error manejado. Esta vulnerabilidad se corrige en la versión 2.7.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "emmett-framework",
          "product": "granian",
          "versions": [
            {
              "version": ">= 0.2.0, < 2.7.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T12:35:15.328399Z",
          "id": "CVE-2026-42545",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        },
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}