CVE catalog

CVE-2024-49768

Waitress vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.49% · Oct 25, 2026

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianwaitresssid3.0.2-2fixed
Debianwaitressforky3.0.2-2fixed
Debianwaitresstrixie3.0.2-1fixed
Debianwaitressbookworm2.1.2-2+deb12u1fixed
Ubuntuwaitressnoble2.1.2-2ubuntu0.1~esm1fixed
Ubuntupython-waitress-docnoble2.1.2-2ubuntu0.1~esm1fixed
Ubuntupython3-waitressnoble2.1.2-2ubuntu0.1~esm1fixed
PyPIwaitressNot reported3.0.1fixed
PyPIwaitressNot reported3.0.1fixed
PyPIwaitressNot reportede4359018537af376cf24bd13616d861e2fb76f65fixed
Ubuntuwaitress20.041.2.0~b2-2vulnerable
Ubuntuwaitress20.041.3.1-4vulnerable
Ubuntuwaitress20.041.4.1-1vulnerable
Ubuntuwaitress20.041.4.1-1ubuntu0.1vulnerable
Ubuntuwaitress20.041.4.1-1ubuntu0.2fixed
Ubuntuwaitress22.041.4.4-1.1vulnerable
Ubuntuwaitress22.041.4.4-1.1ubuntu1vulnerable
Ubuntuwaitress22.041.4.4-1.1ubuntu1.1fixed
Ubuntuwaitresspro2.1.2-2vulnerable
Ubuntuwaitresspro2.1.2-2ubuntu0.1~esm1fixed
Susepython-waitresslinux enterprise module for python 3 15 sp52.1.2-150400.12.7.1fixed
Susepython-waitress-doclinux enterprise module for python 3 15 sp52.1.2-150400.12.7.1fixed
Susepython-waitresslinux enterprise module for python 3 15 sp62.1.2-150400.12.7.1fixed
Susepython-waitress-doclinux enterprise module for python 3 15 sp62.1.2-150400.12.7.1fixed
Susepython-waitresslinux enterprise high performance computing 15 sp4-espos2.1.2-150400.12.7.1fixed
Susepython-waitress-doclinux enterprise high performance computing 15 sp4-espos2.1.2-150400.12.7.1fixed
Susepython-waitresslinux enterprise high performance computing 15 sp4-ltss2.1.2-150400.12.7.1fixed
Susepython-waitress-doclinux enterprise high performance computing 15 sp4-ltss2.1.2-150400.12.7.1fixed
Susepython-waitresslinux enterprise server 15 sp4-ltss2.1.2-150400.12.7.1fixed
Susepython-waitress-doclinux enterprise server 15 sp4-ltss2.1.2-150400.12.7.1fixed
Opensusepython-waitressleap 15.52.1.2-150400.12.7.1fixed
Opensusepython-waitress-docleap 15.52.1.2-150400.12.7.1fixed
Ubuntuwaitresspro2.1.2-2vulnerable
Ubuntuwaitresspro2.1.2-2ubuntu0.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianwaitresssourcesid3.0.1-1not yet assignedNot reported[1086467]
Debianwaitresssourceforky3.0.1-1not yet assignedNot reported[1086467]
Debianwaitresssourcetrixie3.0.1-1not yet assignedNot reported[1086467]
Debianwaitresssourcebookworm2.1.2-2+deb12u1not yet assignedNot reported[1086467]
Ubuntuwaitressdebnoble2.1.2-2ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntupython-waitress-docdebnoble2.1.2-2ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntupython3-waitressdebnoble2.1.2-2ubuntu0.1~esm1Not reportedNot reportedNot reported
PyPIwaitressPyPINot reported3.0.1Not reportedNot reportedNot reported
PyPIwaitressPyPINot reported3.0.1Not reportedNot reportedNot reported
PyPIwaitressPyPINot reportede4359018537af376cf24bd13616d861e2fb76f65Not reportedNot reportedNot reported
Ubuntuwaitressdeb20.041.4.1-1ubuntu0.2Not reportedUSN-7115-1Not reported
Ubuntuwaitressdeb22.041.4.4-1.1ubuntu1.1Not reportedUSN-7115-1Not reported
Ubuntuwaitressdebpro2.1.2-2ubuntu0.1~esm1Not reportedUSN-7115-1Not reported
Susepython-waitressrpmlinux enterprise module for python 3 15 sp52.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Susepython-waitress-docrpmlinux enterprise module for python 3 15 sp52.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Susepython-waitressrpmlinux enterprise module for python 3 15 sp62.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Susepython-waitress-docrpmlinux enterprise module for python 3 15 sp62.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Susepython-waitressrpmlinux enterprise high performance computing 15 sp4-espos2.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Susepython-waitress-docrpmlinux enterprise high performance computing 15 sp4-espos2.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Susepython-waitressrpmlinux enterprise high performance computing 15 sp4-ltss2.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Susepython-waitress-docrpmlinux enterprise high performance computing 15 sp4-ltss2.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Susepython-waitressrpmlinux enterprise server 15 sp4-ltss2.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Susepython-waitress-docrpmlinux enterprise server 15 sp4-ltss2.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Opensusepython-waitressrpmleap 15.52.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Opensusepython-waitress-docrpmleap 15.52.1.2-150400.12.7.1Not reportedSUSE-SU-2024:3876-1Not reported
Ubuntuwaitressdebpro2.1.2-2ubuntu0.1~esm1Not reportedUBUNTU-CVE-2024-49768Not reported

[Debian bug #1086467]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-waitress]Fixed

    Source package: [waitress]

    Details (2)

    • 2.1.2-2+deb12u1 · all · bookworm

      Fixed · Fixed: 2.1.2-2+deb12u1

      usn · waitress · debian · bookworm; usn · waitress · debian · 12

    • 2.1.2-2+deb12u1 · all · bookworm

      Fixed · Fixed: 2.1.2-2+deb12u1

      usn · waitress · debian · bookworm; usn · waitress · debian · 12

  • [python-waitress-doc]Fixed

    Source package: [waitress]

    Details (2)

    • 2.1.2-2+deb12u1 · all · bookworm

      Fixed · Fixed: 2.1.2-2+deb12u1

      usn · waitress · debian · bookworm; usn · waitress · debian · 12

    • 2.1.2-2+deb12u1 · all · bookworm

      Fixed · Fixed: 2.1.2-2+deb12u1

      usn · waitress · debian · bookworm; usn · waitress · debian · 12

[Debian 13 (Trixie)]

  • [python3-waitress]Fixed

    Source package: [waitress]

    Details (2)

    • 3.0.2-1 · all · trixie

      Fixed · Fixed: 3.0.1-1

      usn · waitress · debian · 13

    • 3.0.2-1 · all · trixie

      Fixed · Fixed: 3.0.1-1

      usn · waitress · debian · 13

  • [python-waitress-doc]Fixed

    Source package: [waitress]

    Details (2)

    • 3.0.2-1 · all · trixie

      Fixed · Fixed: 3.0.1-1

      usn · waitress · debian · 13

    • 3.0.2-1 · all · trixie

      Fixed · Fixed: 3.0.1-1

      usn · waitress · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]