CVE-2026-42545

Affected versions of the granian package are vulnerable to Denial of Service due to an unhandled panic in the WSGI response conversion path when a WSGI application emits an invalid HTTP response header name or value. The flaw resides in src/wsgi/io.rs, where the header name and header value constructors are followed by .unwrap() calls, so invalid inputs such as a header name containing whitespace, a header value containing CRLF sequences, or a header value containing a null byte cause a panic that, under the release build setting panic = "abort", aborts the worker process. An attacker who can influence header names or values reflected by the WSGI application, for instance through user-controlled data in Location, Content-Disposition, or custom response headers, can trigger a worker process crash, converting application-level errors that should yield a 500 response into a process termination that denies service until the worker is restarted.