Granian, a Rust HTTP server for Python applications, has a flaw that allows an unauthenticated client to trigger a crash. If a WebSocket upgrade request includes a Sec-WebSocket-Protocol header containing non‑ASCII bytes, the server aborts the worker process before the application is called. The result is a denial‑of‑service that can affect the availability of the entire application. The weakness is rooted in improper input validation (CWE‑20), unforeseen byte handling (CWE‑248), and unchecked resource consumption (CWE‑400).

The vulnerability affects Emmett Framework's Granian server in versions 1.2.0 through 2.7.3, inclusive. The fix is present in 2.7.4 and later. System administrators should verify the installed version and plan an update accordingly.

With a CVSS score of 7.5 the flaw is considered high severity, and while EPSS data is not available, the lack of authentication means any external host can carry out the attack. There is no entry in the CISA KEV catalog, but the potential for large‑scale denial of service can be serious in exposed deployments. Attackers simply send a crafted WebSocket upgrade request containing non‑ASCII characters in the protocol header; no secrets or privileges are required, making exploitation straightforward in network‑visible environments.