Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker
    process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response
    conversion path uses .unwrap() on both the header name and header value constructors, so malformed output
    from the application becomes a process abort instead of a handled error. This vulnerability is fixed in
    2.7.4. (CVE-2026-42545)

ID	Name	Product	Family	Type	Severity
459708	Echo: granian: security update to 2.7.4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459708	Echo: granian: security update to 2.7.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
441312	SCA: security update for granian (GHSA-f5p7-9fr5-8jmj)	Tenable Cloud Security	SCA Checks	Local	medium
441312	SCA: security update for granian (GHSA-f5p7-9fr5-8jmj)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-42545

medium

Tenable Plugins

medium

medium

medium

medium