Waitress · Waitress · CVE-2024-49769
**Name of the Vulnerable Software and Affected Versions**
Waitress versions prior to 3.0.1
**Description**
The issue is related to the `getpeername()` function in the Waitress WSGI server for Python. When a remote client closes the connection before Waitress has the opportunity to call `getpeername()`, it fails to correctly clean up the connection. This leads to the main thread attempting to write to a socket that no longer exists, resulting in a busy-loop calling the write function. A remote attacker could exploit this to run Waitress out of available sockets with minimal resources.
**Recommendations**
For versions prior to 3.0.1, update to Waitress 3.0.1 to remove the race condition.
As a temporary workaround, consider restricting access to the Waitress server to minimize the risk of exploitation.