Description (CNA)
Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| emmett-framework / granian | affected >= 1.2.0, < 2.7.4 |
CWE
CWE-20, CWE-248, CWE-400
References
ADP enrichment
No English description supplied.