Read the docs
TI-2019-12564 Aliases CVE-2019-16785GHSA-pg36-wpm5-g57p

HTTP Request Smuggling: LF vs CRLF handling in Waitress

Priority LOW 38CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 2 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.

Why it matters now

EPSS 0.02537 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial waitress (PyPI): 1.4.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PylonsWaitress<= 1.3.1 – 1.3.1—No fix listedCNA
—waitress (PyPI)before 1.4.01.4.0Patch availableGHSA-pg36-wpm5-g57p
  • Waitress VendorPylons Affected <= 1.3.1 – 1.3.1 Fixed in — No fix listed CNA
  • waitress (PyPI) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-pg36-wpm5-g57p

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:agendaless:waitress:*:*:*:*:*:*:*:*up to 1.3.1VulnerableAgendaless
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableOracle
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:a:redhat:openstack:15:*:*:*:*:*:*:*15VulnerableRed Hat
  • cpe:2.3:a:agendaless:waitress:*:*:*:*:*:*:*:* Versions up to 1.3.1 Vulnerable ·Agendaless
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:a:redhat:openstack:15:*:*:*:*:*:*:* Versions 15 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-pg36-wpm5-g57p waitress (PyPI) Fixed in 1.4.0 Advisory →

Red Hat 2 advisories

  • RHSA-2021:0420 Released 2021-02-04 · Red Hat rating Moderate
    Red Hat Quay v3.4.0 security update
    • Quay v3 quay/clair-rhel8, quay/quay-bridge-operator-bundle, quay/quay-bridge-operator-rhel8 +8
  • RHSA-2020:0720 Released 2020-03-05 · Red Hat rating Low
    python-waitress security update
    • Red Hat OpenStack Platform 15.0 python-waitress-1.4.2-1.el8ost, python3-waitress-1.4.2-1.el8ost

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Pylons Waitress — RHSA-2020:0720

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headersPriority MEDIUM 41
    • TI-2019-12565 HTTP Request Smuggling: Invalid Transfer-Encoding in WaitressPriority LOW 37
    Show all 3 records → Advisory →
  • Advisory ·

    Pylons Waitress — FEDORA-2020-bdcc8ffc24

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headersPriority MEDIUM 41
    • TI-2019-12565 HTTP Request Smuggling: Invalid Transfer-Encoding in WaitressPriority LOW 37
    Show all 3 records → Advisory →
Show 1 more group
  • Advisory ·

    Pylons Waitress — FEDORA-2020-65a7744e38

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headersPriority MEDIUM 41
    • TI-2019-12565 HTTP Request Smuggling: Invalid Transfer-Encoding in WaitressPriority LOW 37
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 3AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 4AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 16 (Train)AffectedNo fix yet
Quay v3Fixed RHSA-2021:0420
Red Hat OpenStack Platform 15.0Fixed RHSA-2020:0720

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-16785
  2. 2026-10-03 Alias added: GHSA-pg36-wpm5-g57p

References

Exploit 1

Patch 2

Advisory 6

Other 4

  • TI-2022-13060 Uncaught Exception (due to a data race) leads to process termination in Waitress CVSS 3.1MEDIUM 6.5
  • TI-2026-39576 WebOb: Open redirect in Location header normalization via leading C0 control / space characters CVSS 3.1MEDIUM 6.1
  • TI-2024-33235 Waitress has request processing race condition in HTTP pipelining with invalid first request CVSS 3.1CRITICAL 9.1
  • TI-2024-33236 Waitress has a denial of service leading to high CPU usage/resource exhaustion CVSS 3.1HIGH 7.5
  • TI-2022-08575 HTTP Request Smuggling in waitress CVSS 3.1HIGH 7.5
  • TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers CVSS 3.1HIGH 8.2
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences