TI-2022-13060 Aliases CVE-2022-31015 GHSA-f5x9-8jwc-25rw

Uncaught Exception (due to a data race) leads to process termination in Waitress

MEDIUM 62CWE-248Published 2022-05-31 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.

Summary

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01498 74th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed waitress (Pylons): 2.1.2waitress (PyPI): 2.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Pylons	waitress	2.1.0 to before 2.1.2	2.1.2	Patch available	CNA
—	waitress (PyPI)	2.1.0 to before 2.1.2	2.1.2	Patch available	GHSA-f5x9-8jwc-25rw

waitress VendorPylons Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available CNA
waitress (PyPI) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-f5x9-8jwc-25rw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:agendaless:waitress::::::::	2.1.0 to before 2.1.2	Vulnerable	Agendaless

cpe:2.3:a:agendaless:waitress:*:*:*:*:*:*:*:* Versions 2.1.0 to before 2.1.2 Vulnerable ·Agendaless

Remediation

Fix · CNA waitress (Pylons) Fixed in 2.1.2
Fix · GHSA-f5x9-8jwc-25rw waitress (PyPI) Fixed in 2.1.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 10 products

Red Hat Ceph Storage 3
Red Hat Ceph Storage 4
Red Hat Ceph Storage 5
Red Hat Ceph Storage 7
Red Hat OpenStack Platform 13 (Queens)
Red Hat OpenStack Platform 16.1
Red Hat OpenStack Platform 16.2
Red Hat Openshift Container Storage 4
Red Hat Openshift Data Foundation 4
Red Hat Quay 3

Timeline

2026-10-02 Threatist record created from CVE-2022-31015
2026-10-03 Alias added: GHSA-f5x9-8jwc-25rw

References

Exploit 1

https://github.com/Pylons/waitress/issues/374

Patch 2

Advisory 2

Other 2

TI-2026-39576 WebOb: Open redirect in Location header normalization via leading C0 control / space characters CVSS 3.1MEDIUM 6.1
TI-2024-33235 Waitress has request processing race condition in HTTP pipelining with invalid first request CVSS 3.1CRITICAL 9.1
TI-2024-33236 Waitress has a denial of service leading to high CPU usage/resource exhaustion CVSS 3.1HIGH 7.5
TI-2022-08575 HTTP Request Smuggling in waitress CVSS 3.1HIGH 7.5
TI-2019-12566 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers CVSS 3.1HIGH 8.2
TI-2019-12564 HTTP Request Smuggling: LF vs CRLF handling in Waitress CVSS 3.1HIGH 7.5

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences