Read the docs
TI-2019-12566 Aliases CVE-2019-16789GHSA-968f-66r5-5v74

HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers

Priority MEDIUM 41CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · None
Fix status
Partial Red Hat: 2 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.

Why it matters now

EPSS 0.02587 85th percentileScored 2026-11-07
Fix Partial Waitress (Pylons): 1.4.1waitress (PyPI): 1.4.2Red Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PylonsWaitress< 1.4.1 to before 1.4.11.4.1Patch availableCNA
—waitress (PyPI)before 1.4.21.4.2Patch availableGHSA-968f-66r5-5v74
  • Waitress VendorPylons Affected < 1.4.1 to before 1.4.1 Fixed in 1.4.1 Patch available CNA
  • waitress (PyPI) Vendor— Affected before 1.4.2 Fixed in 1.4.2 Patch available GHSA-968f-66r5-5v74

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:agendaless:waitress:*:*:*:*:*:*:*:*up to 1.4.0VulnerableAgendaless
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableOracle
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:a:redhat:openstack:15:*:*:*:*:*:*:*15VulnerableRed Hat
  • cpe:2.3:a:agendaless:waitress:*:*:*:*:*:*:*:* Versions up to 1.4.0 Vulnerable ·Agendaless
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:a:redhat:openstack:15:*:*:*:*:*:*:* Versions 15 Vulnerable ·Red Hat

Remediation

  • Fix · CNA Waitress (Pylons) Fixed in 1.4.1
  • Fix · GHSA-968f-66r5-5v74 waitress (PyPI) Fixed in 1.4.2 Advisory →

Red Hat 2 advisories

  • RHSA-2021:0420 Released 2021-02-04 · Red Hat rating Moderate
    Red Hat Quay v3.4.0 security update
    • Quay v3 quay/clair-rhel8, quay/quay-bridge-operator-bundle, quay/quay-bridge-operator-rhel8 +8
  • RHSA-2020:0720 Released 2020-03-05 · Red Hat rating Low
    python-waitress security update
    • Red Hat OpenStack Platform 15.0 python-waitress-1.4.2-1.el8ost, python3-waitress-1.4.2-1.el8ost

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Pylons Waitress — RHSA-2020:0720

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-12564 HTTP Request Smuggling: LF vs CRLF handling in WaitressPriority LOW 38
    • TI-2019-12565 HTTP Request Smuggling: Invalid Transfer-Encoding in WaitressPriority LOW 37
    Show all 3 records → Advisory →
  • Advisory ·

    Pylons Waitress — FEDORA-2020-bdcc8ffc24

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-12564 HTTP Request Smuggling: LF vs CRLF handling in WaitressPriority LOW 38
    • TI-2019-12565 HTTP Request Smuggling: Invalid Transfer-Encoding in WaitressPriority LOW 37
    Show all 3 records → Advisory →
Show 1 more group
  • Advisory ·

    Pylons Waitress — FEDORA-2020-65a7744e38

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-12564 HTTP Request Smuggling: LF vs CRLF handling in WaitressPriority LOW 38
    • TI-2019-12565 HTTP Request Smuggling: Invalid Transfer-Encoding in WaitressPriority LOW 37
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 3AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 4AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 16 (Train)AffectedNo fix yet
Quay v3Fixed RHSA-2021:0420
Red Hat OpenStack Platform 15.0Fixed RHSA-2020:0720

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-16789
  2. 2026-10-03 Alias added: GHSA-968f-66r5-5v74

References

Patch 2

Advisory 8

Other 6

  • TI-2022-13060 Uncaught Exception (due to a data race) leads to process termination in Waitress CVSS 3.1MEDIUM 6.5
  • TI-2026-39576 WebOb: Open redirect in Location header normalization via leading C0 control / space characters CVSS 3.1MEDIUM 6.1
  • TI-2024-33235 Waitress has request processing race condition in HTTP pipelining with invalid first request CVSS 3.1CRITICAL 9.1
  • TI-2024-33236 Waitress has a denial of service leading to high CPU usage/resource exhaustion CVSS 3.1HIGH 7.5
  • TI-2022-08575 HTTP Request Smuggling in waitress CVSS 3.1HIGH 7.5
  • TI-2019-12564 HTTP Request Smuggling: LF vs CRLF handling in Waitress CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences