TI-2024-33235 CVE-2024-49768 · GHSA-9298-4cf8-g4wj
Waitress has request processing race condition in HTTP pipelining with invalid first request
Priority MEDIUM 48
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
Vulnerabilities
10 records
TI-2024-33236 CVE-2024-49769 · GHSA-3f84-rpwh-47g6
Waitress has a denial of service leading to high CPU usage/resource exhaustion
Priority MEDIUM 42
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
TI-2023-21385 CVE-2023-40587 · GHSA-j8g2-6fc7-q8f8
Pyramid static view path traversal up one directory
Priority LOW 25
Pyramid is an open source Python web framework.
TI-2022-13060 CVE-2022-31015 · GHSA-f5x9-8jwc-25rw
Uncaught Exception (due to a data race) leads to process termination in Waitress
Priority MEDIUM 62
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
TI-2022-08575 CVE-2022-24761 · GHSA-4f7p-27jc-3c36
HTTP Request Smuggling in waitress
Priority MEDIUM 42
Waitress is a Web Server Gateway Interface server for Python 2 and 3.
TI-2020-04292 CVE-2020-5236 · GHSA-73m2-3pwg-5fgc
Catastrophic backtracking in regex allows Denial of Service in Waitress
Priority LOW 33
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters.
TI-2019-12569 CVE-2019-16792 · GHSA-4ppp-gpcr-7qf6
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
Priority LOW 37
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice.
TI-2019-12566 CVE-2019-16789 · GHSA-968f-66r5-5v74
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
Priority MEDIUM 41
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential fo…
TI-2019-12564 CVE-2019-16785 · GHSA-pg36-wpm5-g57p
HTTP Request Smuggling: LF vs CRLF handling in Waitress
Priority LOW 38
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a lin…
TI-2019-12565 CVE-2019-16786 · GHSA-g2xc-35jw-c63p
HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
Priority LOW 37
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead.