Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker
    process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol
    header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before
    the ASGI application is invoked. This vulnerability is fixed in 2.7.4. (CVE-2026-42544)

ID	Name	Product	Family	Type	Severity
458618	Echo: granian: security update to 2.7.4	Tenable Cloud Security	Echo Local Security Checks	Local	high
458618	Echo: granian: security update to 2.7.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
441354	SCA: security update for granian (GHSA-vrg7-482j-p6f6)	Tenable Cloud Security	SCA Checks	Local	high
441354	SCA: security update for granian (GHSA-vrg7-482j-p6f6)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-42544

high

Tenable Plugins

high

high

high

high