TI-2019-12565 Aliases CVE-2019-16786 GHSA-g2xc-35jw-c63p

HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

LOW 37CWE-444Published 2019-12-20 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 2 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Why it matters now

EPSS 0.02379 83rd percentileScored 2026-11-07

Fix Partial waitress (PyPI): 1.4.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Pylons	Waitress	<= 1.3.1 – 1.3.1	—	No fix listed	CNA
—	waitress (PyPI)	before 1.4.0	1.4.0	Patch available	GHSA-g2xc-35jw-c63p

Waitress VendorPylons Affected <= 1.3.1 – 1.3.1 Fixed in — No fix listed CNA
waitress (PyPI) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-g2xc-35jw-c63p

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:a:agendaless:waitress::::::::	before 1.3.1	Vulnerable	Agendaless
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:::::::*	1.10.0	Vulnerable	Oracle
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian
cpe:2.3:o:fedoraproject:fedora:30:::::::*	30	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:31:::::::*	31	Vulnerable	Fedoraproject
cpe:2.3:a:redhat:openstack:15:::::::*	15	Vulnerable	Red Hat

cpe:2.3:a:agendaless:waitress:*:*:*:*:*:*:*:* Versions before 1.3.1 Vulnerable ·Agendaless
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
cpe:2.3:a:redhat:openstack:15:*:*:*:*:*:*:* Versions 15 Vulnerable ·Red Hat

Remediation

Fix · GHSA-g2xc-35jw-c63p waitress (PyPI) Fixed in 1.4.0 Advisory →

Red Hat 2 advisories

RHSA-2021:0420 Released 2021-02-04 · Red Hat rating Moderate
Red Hat Quay v3.4.0 security update
- Quay v3 quay/clair-rhel8, quay/quay-bridge-operator-bundle, quay/quay-bridge-operator-rhel8 +8
RHSA-2020:0720 Released 2020-03-05 · Red Hat rating Low
python-waitress security update
- Red Hat OpenStack Platform 15.0 python-waitress-1.4.2-1.el8ost, python3-waitress-1.4.2-1.el8ost

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2019-12-20
Pylons Waitress — RHSA-2020:0720
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headersPriority MEDIUM 41
- TI-2019-12564 HTTP Request Smuggling: LF vs CRLF handling in WaitressPriority LOW 38
Show all 3 records → Advisory →
Advisory · 2019-12-20
Pylons Waitress — FEDORA-2020-bdcc8ffc24
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headersPriority MEDIUM 41
- TI-2019-12564 HTTP Request Smuggling: LF vs CRLF handling in WaitressPriority LOW 38
Show all 3 records → Advisory →

Show 1 more group

Advisory · 2019-12-20
Pylons Waitress — FEDORA-2020-65a7744e38
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headersPriority MEDIUM 41
- TI-2019-12564 HTTP Request Smuggling: LF vs CRLF handling in WaitressPriority LOW 38
Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Ceph Storage 3	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 4	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 16 (Train)	Affected	No fix yet
Quay v3	Fixed	RHSA-2021:0420
Red Hat OpenStack Platform 15.0	Fixed	RHSA-2020:0720

Timeline

2026-10-02 Threatist record created from CVE-2019-16786
2026-10-03 Alias added: GHSA-g2xc-35jw-c63p

References

Patch 2

Advisory 7

Other 4

TI-2022-13060 Uncaught Exception (due to a data race) leads to process termination in Waitress CVSS 3.1MEDIUM 6.5
TI-2026-39576 WebOb: Open redirect in Location header normalization via leading C0 control / space characters CVSS 3.1MEDIUM 6.1
TI-2024-33235 Waitress has request processing race condition in HTTP pipelining with invalid first request CVSS 3.1CRITICAL 9.1
TI-2024-33236 Waitress has a denial of service leading to high CPU usage/resource exhaustion CVSS 3.1HIGH 7.5
TI-2022-08575 HTTP Request Smuggling in waitress CVSS 3.1HIGH 7.5
TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers CVSS 3.1HIGH 8.2

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences