3lc (>=2.19.0, <=2.22.0), 3lc-ultralytics (>=0.1.7, <=0.2.1) +5 more potentially affected by CVE-2026-48061 via litestar (>=2.0.0b2, <=2.15.2)

litestar PYPI version =2.0.0b2, =2.19.0, =0.1.7, =0.1.0, =0.2.0, =0.3.14, =0.3.35 Source cves: CVE-2026-48061 Source advisory: MEND:CVE-2026-48061...

3lc (>=2.19.0, <=2.22.0), 3lc-ultralytics (>=0.1.7, <=0.2.1) +5 more potentially affected by CVE-2026-48060 via litestar (>=2.0.0b2, <=2.15.2)

litestar PYPI version =2.0.0b2, =2.19.0, =0.1.7, =0.1.0, =0.2.0, =0.3.14, =0.3.35 Source cves: CVE-2026-48060 Source advisory: OSV:PYSEC-2026-2604...

3lc (>=2.19.0, <=2.22.0), 3lc-ultralytics (>=0.1.7, <=0.2.1) +5 more potentially affected by CVE-2026-48061 via litestar (>=2.0.0b2, <=2.15.2)

litestar PYPI version =2.0.0b2, =2.19.0, =0.1.7, =0.1.0, =0.2.0, =0.3.14, =0.3.35 Source cves: CVE-2026-48061 Source advisory: OSV:PYSEC-2026-2603...

PYSEC-2026-2502 Granian vulnerable to DoS via WSGI response header panic

Summary Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a...

PYSEC-2026-2503 Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic

Summary Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This is a single-request...

Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic

SummaryGranian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes.The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked.This is a single-request...

aloni (>=0.2.1, <=0.2.3), another (0.1.0) +7 more potentially affected by CVE-2026-42545 via granian (>=0.2.6, <=2.6.1)

granian PYPI version =0.2.6, =0.2.1, =1.0.0, =2.5.0, =1.0.0, =0.2.0, =0.0.1, =2025.1.0b1, =0.1.1, =0.3.1 Source cves: CVE-2026-42545 Source advisory: OSV:PYSEC-2026-2502...

Granian vulnerable to DoS via WSGI response header panic

SummaryGranian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a...

aloni (>=0.2.1, <=0.2.3), code-exec-hz (>=1.0.0, <=1.0.1) +6 more potentially affected by CVE-2026-42544 via granian (>=1.3.2, <=2.6.1)

granian PYPI version =1.3.2, =0.2.1, =1.0.0, =2.5.10, =1.0.0, =0.2.0, =0.0.1, =2025.1.0b1, =0.1.1, =0.3.1 Source cves: CVE-2026-42544 Source advisory: OSV:PYSEC-2026-2503...

PT-2026-59166

Summary Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This is a single-request...

PT-2026-59165

Summary Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a...

3lc (>=2.19.0, <=2.22.0), 3lc-ultralytics (>=0.1.7, <=0.2.1) +5 more potentially affected by CVE-2026-48061 via litestar (>=2.0.0b2, <=2.15.2)

litestar PYPI version =2.0.0b2, =2.19.0, =0.1.7, =0.1.0, =0.2.0, =0.3.14, =0.3.35 Source cves: CVE-2026-48061 Source advisory: GHSA-3QMC-CJ7Q-62HV...

3lc (>=2.19.0, <=2.22.0), 3lc-ultralytics (>=0.1.7, <=0.2.1) +5 more potentially affected by CVE-2026-48061 via litestar (>=2.0.0b2, <=2.15.2)

litestar PYPI version =2.0.0b2, =2.19.0, =0.1.7, =0.1.0, =0.2.0, =0.3.14, =0.3.35 Source cves: CVE-2026-48061 Source advisory: SNYK:PYTHON-LITESTAR-17304677...

3lc (>=2.19.0, <=2.22.0), 3lc-ultralytics (>=0.1.7, <=0.2.1) +5 more potentially affected by CVE-2026-48060 via litestar (>=2.0.0b2, <=2.15.2)

litestar PYPI version =2.0.0b2, =2.19.0, =0.1.7, =0.1.0, =0.2.0, =0.3.14, =0.3.35 Source cves: CVE-2026-48060 Source advisory: GHSA-542P-WVX7-72M4...

CVE-2026-42544

Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction...

CVE-2026-42545

Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap on both the header name and header value constructors, so malform...

CVE-2026-42544

Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction...

CVE-2026-42545

Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap on both the header name and header value constructors, so malform...

CVE-2026-42545 Granian: DoS via WSGI response header panic

Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap on both the header name and header value constructors, so malform...

aloni (>=0.2.1, <=0.2.3), another (0.1.0) +7 more potentially affected by CVE-2026-42545 via granian (>=0.2.6, <=2.6.1)

granian PYPI version =0.2.6, =0.2.1, =1.0.0, =2.5.0, =1.0.0, =0.2.0, =0.0.1, =2025.1.0b1, =0.1.1, =0.3.1 Source cves: CVE-2026-42545 Source advisory: MEND:CVE-2026-42545...