CVE-2019-16786

Waitress (Python WSGI server) before version 1.4.0 exposed an HTTP request-smuggling vulnerability related to Transfer-Encoding. If a request’s Transfer-Encoding header was not finalised as chunked, Waitress could ignore the header and fall back to Content-Length, potentially allowing HTTP pipeli...

CVE-2019-16785

Summary: The vulnerability CVE-2019-16785 affects Waitress (Python WSGI server) up to v1.3.1. It relates to RFC7230’s line-termination rule: Waitress may treat messages inconsistently when a proxy uses LF vs CRLF, enabling HTTP request smuggling/splitting. Impact is the front-end and back-end par...

CVE-2019-16789

Affected software: Waitress (Python WSGI server) up to version 1.4.0. Vulnerability arises when a front-end proxy sends requests with Transfer-Encoding containing invalid whitespace characters; Waitress may parse such requests as chunked while the front-end uses Content-Length, enabling HTTP requ...

CVE-2022-24761

CVE-2022-24761 affects Waitress (Python WSGI server) up to version 2.1.0. The advisory describes two vulnerability classes that enable HTTP request smuggling when Waitress runs behind a proxy that does not fully validate RFC7230: (1) parsing integers with Python int(), allowing +10 to be treated ...

CVE-2019-16792

CVE-2019-16792 affects Waitress up to version 1.3.1, where sending two Content-Length headers can cause a request to be treated as having no body and the body of the request becoming a new request in HTTP pipelining. The issue is caused by header folding of a double Content-Length and an inabilit...

CVE-2024-49768

CVE-2024-49768 (Waitress) : A race condition in HTTP pipelining with request lookahead can cause a mismanaged second request while the first is being processed. Waitress 3.0.1 fixes the race; as a workaround, disable channel_request_lookahead (default 0). Public advisories reference exposure in I...

CVE-2022-31015

CVE-2022-31015 affects the Python WSGI server Waitress, specifically versions 2.1.0 and 2.1.1. The root cause is a thread closing a socket while the main thread is about to call select(), causing the main thread to raise an unhandled exception and potentially terminate the entire application. The...

CVE-2020-5236

CVE-2020-5236 affects the Python WSGI server waitress. A flaw in the regex used to validate incoming HTTP headers allows catastrophic backtracking when headers contain invalid characters (e.g., Bad-header: xxxxxxxxxxxxxxx\x10), causing the server to hit 100% CPU and deny service. The issue was in...

CVE-2024-49769

Waitress (Python WSGI server) is affected by CVE-2024-49769 due to a race condition when a remote client closes a connection before getpeername() is called, causing the main thread to attempt writing to a socket that remains in the processing list and potentially leading to a DoS by exhausting av...