HTTP Request Smuggling: Content-Length Sent Twice in Waitress
Priority LOW 37CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Why it matters now
EPSS 0.01984 80th percentileScored 2026-11-07
Fix Fixed waitress (PyPI): 1.4.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pylons | Waitress | <= 1.3.1 – 1.3.1 | — | No fix listed | CNA |
| — | waitress (PyPI) | before 1.4.0 | 1.4.0 | Patch available | GHSA-4ppp-gpcr-7qf6 |
- Waitress VendorPylons Affected <= 1.3.1 – 1.3.1 Fixed in — No fix listed CNA
- waitress (PyPI) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-4ppp-gpcr-7qf6
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:agendaless:waitress:*:*:*:*:*:*:*:* | up to 1.3.1 | Vulnerable | Agendaless |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* | 1.10.0 | Vulnerable | Oracle |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:agendaless:waitress:*:*:*:*:*:*:*:* Versions up to 1.3.1 Vulnerable ·Agendaless
- cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-4ppp-gpcr-7qf6 waitress (PyPI) Fixed in 1.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-16792
- 2026-10-03 Alias added: GHSA-4ppp-gpcr-7qf6
References
Patch 2
Advisory 3
More Pylons vulnerabilities
- TI-2022-13060 Uncaught Exception (due to a data race) leads to process termination in Waitress CVSS 3.1MEDIUM 6.5
- TI-2026-39576 WebOb: Open redirect in Location header normalization via leading C0 control / space characters CVSS 3.1MEDIUM 6.1
- TI-2024-33235 Waitress has request processing race condition in HTTP pipelining with invalid first request CVSS 3.1CRITICAL 9.1
- TI-2024-33236 Waitress has a denial of service leading to high CPU usage/resource exhaustion CVSS 3.1HIGH 7.5
- TI-2022-08575 HTTP Request Smuggling in waitress CVSS 3.1HIGH 7.5
- TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers CVSS 3.1HIGH 8.2
Sources
- CVE-2019-16792 · CVE Program
- CVE-2019-16792 · NVD
- FIRST EPSS
- GHSA-4ppp-gpcr-7qf6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences