PT-2024-9201 · Waitress+5 · Waitress+5
Digitalresistor
+2
·
Published
2024-10-29
·
Updated
2025-09-03
·
CVE-2024-49768
CVSS v2.0
9.4
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions:
Waitress versions prior to 3.0.1
Description:
The issue is related to a race condition in the Waitress WSGI server for Python, which can be exploited by a remote client sending a request that is exactly
recv bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while reading the next request and queueing it. This allows the secondary request to be serviced by the worker thread while the connection should be closed.Recommendations:
For versions prior to 3.0.1, update to Waitress 3.0.1 to fix the race condition.
As a temporary workaround, disable
channel request lookahead, which is set to 0 by default, disabling this feature.Exploit
Fix
HTTP Request/Response Smuggling
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Suse
Ubuntu
Waitress