PT-2022-20460 · Pypi · Waitress

Digitalresistor + 1 · Published 2022-05-31 · Updated 2025-05-17 · CVE-2022-31015

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Waitress versions 2.1.0 through 2.1.1

Description Waitress is a Web Server Gateway Interface server for Python 2 and 3. The issue arises when a thread closes a socket while the main thread is about to call select(), leading to the main thread raising an exception that is not handled, causing the entire application to be killed. Users using Waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

Recommendations For Waitress versions 2.1.0 and 2.1.1, update to Waitress 2.1.2, which fixes the issue by no longer allowing the WSGI thread to close the socket, instead delegating this action to the main thread. As a temporary workaround for users who cannot update immediately, consider using Waitress behind a reverse proxy server that always reads the full response to minimize the risk of application termination.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-248

CWE-362

Related Identifiers

AZL-43513

AZL-44571

CVE-2022-31015

GHSA-F5X9-8JWC-25RW

OPENSUSE-SU-2024:12346-1

OPENSUSE-SU-2025:15108-1

PYSEC-2022-205

Affected Products

Waitress

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31015.json · Exploit
• 🔥 https://github.com/Pylons/waitress/issues/374 · Exploit
• https://github.com/Pylons/waitress/pull/377 · Patch
• https://github.com/Pylons/waitress/commit/4f6789b035610e0552738cdc4b35ca809a592d48 · Patch
• https://osv.dev/vulnerability/AZL-44571 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-31015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31015 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15108-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43513 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-205 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f5x9-8jwc-25rw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31015 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-31015 · Vendor Advisory
• https://github.com/Pylons/waitress/security/advisories/GHSA-f5x9-8jwc-25rw · Note
• https://github.com/Pylons/waitress · Note