CVE-2026-42544

Affected versions of the granian package are vulnerable to Denial of Service due to an unhandled panic when constructing the WebSocket scope from a request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The flaw resides in the WebSocket scope construction path in src/asgi/utils.rs, where HeaderValue::to_str() returns an error for non-visible-ASCII bytes and the subsequent .unwrap() panics, which under the release build setting panic = "abort" terminates the worker process before the ASGI application is invoked. An unauthenticated remote attacker can send a single crafted WebSocket upgrade request with a malformed subprotocol header to abort one worker, and by repeating the request across workers can take the entire service offline.