PT-2023-9786 · Waitress+6 · Waitress+6
Djay
·
Published
2023-09-11
·
Updated
2025-09-22
·
CVE-2024-49769
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Waitress versions prior to 3.0.1
Description
The issue is related to the
getpeername() function in the Waitress WSGI server for Python. When a remote client closes the connection before Waitress has the opportunity to call getpeername(), it fails to correctly clean up the connection. This leads to the main thread attempting to write to a socket that no longer exists, resulting in a busy-loop calling the write function. A remote attacker could exploit this to run Waitress out of available sockets with minimal resources.Recommendations
For versions prior to 3.0.1, update to Waitress 3.0.1 to remove the race condition.
As a temporary workaround, consider restricting access to the Waitress server to minimize the risk of exploitation.
Exploit
Fix
DoS
Missing Release of Resource after Effective Lifetime
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Red Os
Suse
Ubuntu
Waitress