Catastrophic backtracking in regex allows Denial of Service in Waitress
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pylons | Waitress | = 1.4.2 | — | No fix listed | CNA |
| — | waitress (PyPI) | 1.4.2 to before 1.4.3 | 1.4.3 | Patch available | GHSA-73m2-3pwg-5fgc |
- Waitress VendorPylons Affected = 1.4.2 Fixed in — No fix listed CNA
- waitress (PyPI) Vendor— Affected 1.4.2 to before 1.4.3 Fixed in 1.4.3 Patch available GHSA-73m2-3pwg-5fgc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:agendaless:waitress:1.4.2:*:*:*:*:*:*:* | 1.4.2 | Vulnerable | Agendaless |
- cpe:2.3:a:agendaless:waitress:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·Agendaless
Remediation
- Fix · GHSA-73m2-3pwg-5fgc waitress (PyPI) Fixed in 1.4.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 15 (Stein) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16 (Train) | Affected | No fix yet: Fix deferred |
Not affected: 5 products
- Red Hat Ceph Storage 3
- Red Hat Ceph Storage 4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5236
- 2026-10-03 Alias added: GHSA-73m2-3pwg-5fgc
References
Advisory 2
More Pylons vulnerabilities
- TI-2022-13060 Uncaught Exception (due to a data race) leads to process termination in Waitress CVSS 3.1MEDIUM 6.5
- TI-2026-39576 WebOb: Open redirect in Location header normalization via leading C0 control / space characters CVSS 3.1MEDIUM 6.1
- TI-2024-33235 Waitress has request processing race condition in HTTP pipelining with invalid first request CVSS 3.1CRITICAL 9.1
- TI-2024-33236 Waitress has a denial of service leading to high CPU usage/resource exhaustion CVSS 3.1HIGH 7.5
- TI-2022-08575 HTTP Request Smuggling in waitress CVSS 3.1HIGH 7.5
- TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers CVSS 3.1HIGH 8.2
Sources
- CVE-2020-5236 · CVE Program
- CVE-2020-5236 · NVD
- FIRST EPSS
- GHSA-73m2-3pwg-5fgc · GitHub Advisory Database · CC BY 4.0
- CVE-2020-5236 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences