Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This issue requires a buggy or attacker-influenced WSGI application to emit invalid headers. It is not a parser bug in Granian's request path. The security impact is that application mistakes which should result in a 500 instead kill the worker process. Details https://github.com/emmett-framework/granian/blob/bdd5b0fbbb2aca6f2f4c0d2700c244d190958035/src/wsgi/io.rs#L39-L42 If either conversion fails, .unwrap() panics. In release builds Granian uses panic = "abort", so the panic terminates the worker. Preconditions The attacker must be able to influence a header name or value produced by the WSGI application, or the application must otherwise generate invalid headers. Examples…
Recommended action: Upgrade to 2.7.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This is a single-request Denial Of Service against one worker. Repeating the request across workers takes the service offline. Details https://github.com/emmett-framework/granian/blob/bdd5b0fbbb2aca6f2f4c0d2700c244d190958035/src/asgi/utils.rs#L122-L125 HeaderValue::tostr() returns Err for bytes outside visible ASCII. The subsequent .unwrap() panics. In release builds Granian sets panic = "abort", so this panic terminates the worker instead of being handled as a normal request error. PoC Step 1. starts a Granian ASGI server Step 2. sending a raw upgrade request with Sec-WebSocket-Protocol: \x80\xff reached this code path and caused the worker to abort. Observed server output: Impact - Unauthenticated remote denial of…
Recommended action: Upgrade to 2.7.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.