Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

waitress

9 known vulnerabilities (1 critical, 6 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 1 critical, 6 high, 2 medium
Registry
PyPI

Advisories 9

  • CVE-2024-49768Critical 9.1

    Waitress has request processing race condition in HTTP pipelining with invalid first request

    Affected: from 2.0.0, fixed in 3.0.1.

  • Waitress has a denial of service leading to high CPU usage/resource exhaustion

    Affected: fixed in 3.0.1.

  • CVE-2022-31015Medium 6.5

    Uncaught Exception (due to a data race) leads to process termination in Waitress

    Affected: from 2.1.0, fixed in 2.1.2.

  • HTTP Request Smuggling in waitress

    Affected: fixed in 2.1.1.

  • CVE-2020-5236Medium 5.7

    Catastrophic backtracking in regex allows Denial of Service in Waitress

    Affected: from 1.4.2, fixed in 1.4.3; fixed in 1.4.3.

  • HTTP Request Smuggling: Content-Length Sent Twice in Waitress

    Affected: fixed in 1.4.0; fixed in 1.4.0.

  • HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers

    Affected: fixed in 1.4.1; fixed in 1.4.2.

  • HTTP Request Smuggling: LF vs CRLF handling in Waitress

    Affected: fixed in 1.4.0; fixed in 1.4.0.

  • HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

    Affected: fixed in 1.4.0; fixed in 1.3.1.