CVE catalog

CVE-2019-16789

waitress affected and fixed versions

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.

Severity: High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Published: Dec 26, 2019, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.59% · Oct 27, 2026

Projects and upstream resources

[waitress][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	waitress	`1.4.1-1`	FixedDistribution-reported fixed boundary	[CVE-2019-16789]
Debiantrixie	waitress	`3.0.2-1`	Fixed	[CVE-2019-16789]
Debiansid	waitress	`1.4.1-1`	FixedDistribution-reported fixed boundary	[CVE-2019-16789]
Debiansid	waitress	`3.0.2-2`	Fixed	[CVE-2019-16789]
Debianforky	waitress	`1.4.1-1`	FixedDistribution-reported fixed boundary	[CVE-2019-16789]
Debianforky	waitress	`3.0.2-2`	Fixed	[CVE-2019-16789]
Debianbookworm	waitress	`1.4.1-1`	FixedDistribution-reported fixed boundary	[CVE-2019-16789]
Debianbookworm	waitress	`2.1.2-2+deb12u1`	Fixed	[CVE-2019-16789]

Showing 8 fix observations. All 11 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	waitress	`1.4.1-1`	FixedDistribution-reported fixed boundary	[CVE-2019-16789]
Debianbookworm	waitress	`2.1.2-2+deb12u1`	Fixed	[CVE-2019-16789]
Debianforky	waitress	`1.4.1-1`	FixedDistribution-reported fixed boundary	[CVE-2019-16789]
Debianforky	waitress	`3.0.2-2`	Fixed	[CVE-2019-16789]
Debiansid	waitress	`1.4.1-1`	FixedDistribution-reported fixed boundary	[CVE-2019-16789]
Debiansid	waitress	`3.0.2-2`	Fixed	[CVE-2019-16789]
Debiantrixie	waitress	`1.4.1-1`	FixedDistribution-reported fixed boundary	[CVE-2019-16789]
Debiantrixie	waitress	`3.0.2-1`	Fixed	[CVE-2019-16789]
Ubuntu16.04	waitress	`0.8.10-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-16789]Oct 24, 2025, 4:47:53 AM UTC
Ubuntu16.04	waitress	`0.8.9-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-16789]Oct 24, 2025, 4:47:53 AM UTC
Ubuntu18.04	waitress	`1.0.1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-16789]Oct 24, 2025, 4:47:53 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "waitress",
      "status": "fixed",
      "release": "sid",
      "version": "3.0.2-2"
    },
    {
      "name": "waitress",
      "status": "fixed",
      "release": "forky",
      "version": "3.0.2-2"
    },
    {
      "name": "waitress",
      "status": "fixed",
      "release": "trixie",
      "version": "3.0.2-1"
    },
    {
      "name": "waitress",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.1.2-2+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 947433,
      "name": "waitress",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.4.1-1"
    },
    {
      "bug": 947433,
      "name": "waitress",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.4.1-1"
    },
    {
      "bug": 947433,
      "name": "waitress",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.4.1-1"
    },
    {
      "bug": 947433,
      "name": "waitress",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.4.1-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "waitress",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "0.8.9-2ubuntu1",
        "0.8.10-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-16789",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-16789",
      "provider_updated_at": "2025-10-24T04:47:53Z",
      "applicability_unknown": true
    },
    {
      "name": "waitress",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.0.1-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-16789",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-16789",
      "provider_updated_at": "2025-10-24T04:47:53Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #947433]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[python3-waitress]Unknown
Source package: [waitress]
Details (2)
- 2.1.2-2+deb12u1 · all · bookworm
  Fixed · Fixed: 1.4.1-1
  dsa · waitress · debian · bookworm; dsa · waitress · debian · 12
- 2.1.2-2+deb12u1 · all · bookworm
  Fixed · Fixed: 1.4.1-1
  dsa · waitress · debian · bookworm; dsa · waitress · debian · 12
[python-waitress-doc]Unknown
Source package: [waitress]
Details (2)
- 2.1.2-2+deb12u1 · all · bookworm
  Fixed · Fixed: 1.4.1-1
  dsa · waitress · debian · bookworm; dsa · waitress · debian · 12
- 2.1.2-2+deb12u1 · all · bookworm
  Fixed · Fixed: 1.4.1-1
  dsa · waitress · debian · bookworm; dsa · waitress · debian · 12

[Debian 13 (Trixie)]

[python3-waitress]Unknown
Source package: [waitress]
Details (2)
- 3.0.2-1 · all · trixie
  Fixed · Fixed: 1.4.1-1
  dsa · waitress · debian · 13
- 3.0.2-1 · all · trixie
  Fixed · Fixed: 1.4.1-1
  dsa · waitress · debian · 13
[python-waitress-doc]Unknown
Source package: [waitress]
Details (2)
- 3.0.2-1 · all · trixie
  Fixed · Fixed: 1.4.1-1
  dsa · waitress · debian · 13
- 3.0.2-1 · all · trixie
  Fixed · Fixed: 1.4.1-1
  dsa · waitress · debian · 13

Observed: Oct 23, 2026, 5:41:32 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]