Waitress has request processing race condition in HTTP pipelining with invalid first request
Impact
A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining.
When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection.
However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed.
Patches
Waitress 3.0.1 fixes the race condition.
Workarounds
Disable channel_request_lookahead, this is set to 0 by default disabling this feature. For this vulnerability this value is required to be changed from the default.
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/Pylons/waitress/issues (if not sensitive or security related)
- email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Thanks
- m4yfly and urn1ce From TianGong Team of Legendsec at Qi'anxin Group.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | waitress | >= 2.0.0, < 3.0.1 | 3.0.1 |
References
- https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj
- https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65
- https://nvd.nist.gov/vuln/detail/CVE-2024-49768
- https://github.com/Pylons/waitress
- https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2024-210.yaml
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-367, CWE-444- Platform
- Python (PyPI)
- Package
waitress- Disclosed
- 29.10.2024
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2024-210 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-9298-4cf8-g4wj - CC BY 4.0
Vulnerability history: waitress
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 10
- First → latest
- 12.2019 10.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 4
- Medium 4
Disclosures per year
- 2019: 5
- 2020: 1
- 2021: 0
- 2022: 2
- 2023: 0
- 2024: 2
- 2025: 0
- 2026: 0
-
Waitress has request processing race condition in HTTP pipelining with invalid first request this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.