Home
Trends
Vulnerabilities
News
Researchers
Why dbugs?

Djay

#30160of 53,611
8.7Total CVSS
Vulnerabilities · 1
PT-2023-9786
8.7
2023-09-11
Waitress · Waitress · CVE-2024-49769
**Name of the Vulnerable Software and Affected Versions** Waitress versions prior to 3.0.1 **Description** The issue is related to the `getpeername()` function in the Waitress WSGI server for Python. When a remote client closes the connection before Waitress has the opportunity to call `getpeername()`, it fails to correctly clean up the connection. This leads to the main thread attempting to write to a socket that no longer exists, resulting in a busy-loop calling the write function. A remote attacker could exploit this to run Waitress out of available sockets with minimal resources. **Recommendations** For versions prior to 3.0.1, update to Waitress 3.0.1 to remove the race condition. As a temporary workaround, consider restricting access to the Waitress server to minimize the risk of exploitation.