Granian, a Rust HTTP server for Python WSGI applications, terminates worker processes when the application returns a malformed HTTP header name or value. The server’s header conversion path unwraps both the header name and value, causing a panic on invalid data. One or more workers are aborted, resulting in a temporary denial of service until the server is restarted or affected workers are re‑spun. This flaw is a classic example of an unhandled panic leading to process termination (CWE‑248 and CWE‑755).

The vulnerability affects emmett-framework’s Granian versions 0.2.0 through 2.7.3 inclusive. Version 2.7.4 and later contain the fix and are not susceptible to this issue.

The CVSS score of 5.9 places the flaw in the medium severity range. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must be able to influence the WSGI application’s output—typically by sending crafted HTTP requests that cause the application to produce malformed header names or values. Once such input is processed, the server unwraps the invalid data, panics, and aborts the worker, which can be observed as a service interruption. The exploit does not require privileged access and can be performed remotely by triggering malformed HTTP responses via the application.