Waitress has request processing race condition in HTTP pipelining with invalid first request

Impact A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the first request fails due to a parsing error, we simply close th...

aberoth-ephemeris (>=1.0.0 <=1.0.2), adop (>=0.0.1 <=0.0.4) +267 more potentially affected by CVE-2024-49769 via waitress (>=0.8.10 <=3.0.0)

waitress PYPI version =0.8.10, =1.0.0, =0.0.1, =0.0.1, =0.0.4, =0.0.13, =1.1.0, =0.1.13, =1.0.2, =0.1.1, =0.0.1, =0.2.0, =0.1.1, =0.1.7 and more Source cves: CVE-2024-49769 Source advisory: OSV:GHSA-3F84-RPWH-47G6...

Missing Release of Resource after Effective Lifetime

Overview waitress is a production-quality pure-Python WSGI server with very acceptable performance. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to the improper handling of socket connections when a remote client prematurely closes t...

aberoth-ephemeris (>=1.0.0 <=1.0.2), anomalyx (>=0.1.13 <=0.1.15) +17 more potentially affected by CVE-2024-49769 via waitress (=3.0.0)

waitress PYPI version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - aberoth-ephemeris =1.0.0, =0.1.13, =0.1.0, =0.29.0b2, =1.16.0, =0.16.0, =0.3.2, =0.0.2, =2.0.0b14, =1.0.0, =1.0.0.9 and more Source cves:...

GHSA-3F84-RPWH-47G6 Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion

Impact When a remote client closes the connection before waitress has had the opportunity to call getpeername waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt ...

Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion

Impact When a remote client closes the connection before waitress has had the opportunity to call getpeername waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt ...

CVE-2024-49768 Waitress has request processing race condition in HTTP pipelining with invalid first request

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the...

CVE-2024-49768 Waitress has request processing race condition in HTTP pipelining with invalid first request

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the...

CVE-2024-49768

CVE-2024-49768 (Waitress) : A race condition in HTTP pipelining with request lookahead can cause a mismanaged second request while the first is being processed. Waitress 3.0.1 fixes the race; as a workaround, disable channel_request_lookahead (default 0). Public advisories reference exposure in I...

CVE-2024-49768 Waitress has request processing race condition in HTTP pipelining with invalid first request

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the...

CVE-2024-49768

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the...

CVE-2024-49769 Waitress has a denial of service leading to high CPU usage/resource exhaustion

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer...

CVE-2024-49769

Waitress (Python WSGI server) is affected by CVE-2024-49769 due to a race condition when a remote client closes a connection before getpeername() is called, causing the main thread to attempt writing to a socket that remains in the processing list and potentially leading to a DoS by exhausting av...

CVE-2024-49769 Waitress has a denial of service leading to high CPU usage/resource exhaustion

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer...

CVE-2024-49769 Waitress has a denial of service leading to high CPU usage/resource exhaustion

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer...

CVE-2024-49769

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer...

PT-2024-9201

Name of the Vulnerable Software and Affected Versions: Waitress versions prior to 3.0.1 Description: The issue is related to a race condition in the Waitress WSGI server for Python, which can be exploited by a remote client sending a request that is exactly recv bytes defaults to 8192 long,...

Waitress 安全漏洞

Waitress is a production-quality, pure Python WSGI server from the Pylons project. A security vulnerability existed prior to Waitress version 3.0.1, which stemmed from the fact that if a remote client closed a connection before waitress called getpeername, waitress would fail to clean up the...

Waitress 安全漏洞

Waitress is a production-quality, pure Python WSGI server from the Pylons project. A security vulnerability existed prior to Waitress version 3.0.1, which stemmed from the inclusion of a race condition issue...

RHSA-2020:0720 Red Hat Security Advisory: python-waitress security update

Bulletin has no description...