CVE-2020-5236

Waitress 1.4.2 ReDoS - CVE-2020-5236 Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the...

python313-waitress-3.0.2-1.7 on GA media (moderate)

python313-waitress-3.0.2-1.7 on GA media Announcement ID: openSUSE-SU-2026:12047-1 Rating: moderate Cross-References: CVE-2024-49769 CVSS scores: CVE-2024-49769 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2024-49769 SUSE : 8.7...

Astra Linux – vulnerability in waitress

Waitress versions up to 1.3.1 would parse the Transfer-Encoding header and look for a single string value; if that value was not chunked, it would fall back to using the Content-Length header instead. According to the HTTP standard, Transfer-Encoding should be a comma-separated list, with the...

Astra Linux – Vulnerability in Waitress

Waitress version 1.3.1 allows for the smuggling of requests by sending the Content-Length header twice. Waitress would fold the two Content-Length headers together, and since it cannot convert the now comma-separated values into integers, it internally sets the Content-Length to 0. If two...

Astra Linux - vulnerability in waitress

Waitress version 1.3.1 implemented a “MAY” clause in RFC7230, which states: “Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR.” Unfortunately, if a front-end server does n...

OPENSUSE-SU-2026:12047-1 python313-waitress-3.0.2-1.7 on GA media

These are all security issues fixed in the python313-waitress-3.0.2-1.7 package on the GA media of openSUSE Tumbleweed...

PT-2026-105756

These are all security issues fixed in the python313-waitress-3.0.2-1.7 package on the GA media of openSUSE Tumbleweed...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-waitress (UTSA-2026-054067)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054067 advisory. Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the...

Astra Linux – Vulnerability in Waitress

In Waitress version 1.4.0, if a proxy server is used in front of Waitress, an attacker may send an invalid request that bypasses the front-end and is parsed differently by Waitress. This could lead to HTTP request smuggling. Specifically, requests containing special whitespace characters in the...

Astra Linux – Vulnerability in Waitress

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before Waitress has had the opportunity to call getpeername, Waitress will not properly clean up the connection. As a result, the main thread attempts to write to a socket that no long...

Astra Linux – Vulnerability in Waitress

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and earlier behind a proxy that does not properly validate whether the incoming HTTP requests comply with the RFC7230 standard, Waitress and the frontend proxy may disagree on where one reques...

CLSA-2025-1750810248 TuxCare security update for waitress (1 CVE)

TuxCare rebuilt waitress to address 1 CVE. Fixed in 2.1.2.post2+tuxcare...

CLSA-2025-1750810247 TuxCare security update for waitress (1 CVE)

TuxCare rebuilt waitress to address 1 CVE. Fixed in 2.1.2.post1+tuxcare...

PT-2026-73466

TuxCare rebuilt waitress to address 1 CVE. Fixed in 2.1.2.post1+tuxcare...

PT-2026-73467

TuxCare rebuilt waitress to address 1 CVE. Fixed in 2.1.2.post2+tuxcare...

Unity Linux 20.1050e / 20.1070e Security Update: python-waitress (UTSA-2026-016504)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016504 advisory. Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call...

RHCOS 9 : OpenShift Container Platform 4.15.39 (RHSA-2024:10145)

The remote Red Hat Enterprise Linux CoreOS 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:10145 advisory. - waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request CVE-2024-49768 -...

RHCOS 9 : OpenShift Container Platform 4.16.23 (RHSA-2024:9618)

The remote Red Hat Enterprise Linux CoreOS 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9618 advisory. - waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request CVE-2024-49768 -...

RHCOS 9 : OpenShift Container Platform 4.12.70 (RHSA-2024:10535)

The remote Red Hat Enterprise Linux CoreOS 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:10535 advisory. - waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request CVE-2024-49768 -...

RHCOS 9 : OpenShift Container Platform 4.14.41 (RHSA-2024:9623)

The remote Red Hat Enterprise Linux CoreOS 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9623 advisory. - waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request CVE-2024-49768 -...