TI-2022-13060 CVE-2022-31015 · GHSA-f5x9-8jwc-25rw
Uncaught Exception (due to a data race) leads to process termination in Waitress
Priority MEDIUM 62
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
Pylons
Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
Pylons records in CISA KEVNo Pylons vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
15 records
TI-2026-39576 CVE-2026-54770 · GHSA-6hx8-3wjj-gr8g
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
Priority MEDIUM 60
WebOb provides objects for HTTP requests and responses.
TI-2024-33235 CVE-2024-49768 · GHSA-9298-4cf8-g4wj
Waitress has request processing race condition in HTTP pipelining with invalid first request
Priority MEDIUM 48
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
TI-2024-33236 CVE-2024-49769 · GHSA-3f84-rpwh-47g6
Waitress has a denial of service leading to high CPU usage/resource exhaustion
Priority MEDIUM 42
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
TI-2022-08575 CVE-2022-24761 · GHSA-4f7p-27jc-3c36
HTTP Request Smuggling in waitress
Priority MEDIUM 42
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
TI-2019-12566 CVE-2019-16789 · GHSA-968f-66r5-5v74
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
Priority MEDIUM 41
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential fo…
TI-2019-12564 CVE-2019-16785 · GHSA-pg36-wpm5-g57p
HTTP Request Smuggling: LF vs CRLF handling in Waitress
Priority LOW 38
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a lin…
TI-2019-12569 CVE-2019-16792 · GHSA-4ppp-gpcr-7qf6
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
Priority LOW 37
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice.
TI-2019-12565 CVE-2019-16786 · GHSA-g2xc-35jw-c63p
HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
Priority LOW 37
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead.
TI-2017-13535 CVE-2017-18361 · GHSA-rv95-4wxj-6fqq
In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause…
Priority LOW 37
In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.
TI-2020-04292 CVE-2020-5236 · GHSA-73m2-3pwg-5fgc
Catastrophic backtracking in regex allows Denial of Service in Waitress
Priority LOW 33
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters.
TI-2024-28340 CVE-2024-42353 · GHSA-mg3v-6m49-jhp3
WebOb's location header normalization during redirect leads to open redirect
Priority LOW 28
WebOb provides objects for HTTP requests and responses.
TI-2026-32764 CVE-2026-44889 · GHSA-fh3h-vg37-cc95
WebOb: Location header normalization during redirect leads to open redirect
Priority LOW 27
WebOb provides objects for HTTP requests and responses.
TI-2023-21385 CVE-2023-40587 · GHSA-j8g2-6fc7-q8f8
Pyramid static view path traversal up one directory
Priority LOW 25
Pyramid is an open source Python web framework.
TI-2014-08357 CVE-2014-125056 · GHSA-w4cx-v96x-c4g8
Pylons horus services.py timing discrepancy
Priority LOW 25
A vulnerability was found in Pylons horus and classified as problematic.