TI-2022-13060 CVE-2022-31015 · GHSA-f5x9-8jwc-25rw
Uncaught Exception (due to a data race) leads to process termination in Waitress
Priority MEDIUM 62
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
Agendaless
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
Agendaless records in CISA KEVNo Agendaless vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records in Waitress · all components
TI-2024-33235 CVE-2024-49768 · GHSA-9298-4cf8-g4wj
Waitress has request processing race condition in HTTP pipelining with invalid first request
Priority MEDIUM 48
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
TI-2024-33236 CVE-2024-49769 · GHSA-3f84-rpwh-47g6
Waitress has a denial of service leading to high CPU usage/resource exhaustion
Priority MEDIUM 42
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
TI-2022-08575 CVE-2022-24761 · GHSA-4f7p-27jc-3c36
HTTP Request Smuggling in waitress
Priority MEDIUM 42
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
TI-2019-12566 CVE-2019-16789 · GHSA-968f-66r5-5v74
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
Priority MEDIUM 41
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential fo…
TI-2019-12564 CVE-2019-16785 · GHSA-pg36-wpm5-g57p
HTTP Request Smuggling: LF vs CRLF handling in Waitress
Priority LOW 38
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a lin…
TI-2019-12569 CVE-2019-16792 · GHSA-4ppp-gpcr-7qf6
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
Priority LOW 37
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice.
TI-2019-12565 CVE-2019-16786 · GHSA-g2xc-35jw-c63p
HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
Priority LOW 37
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead.
TI-2020-04292 CVE-2020-5236 · GHSA-73m2-3pwg-5fgc
Catastrophic backtracking in regex allows Denial of Service in Waitress
Priority LOW 33
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters.