CVE-2022-24761: HTTP Request Smuggling in waitress
Summary
CVE-2022-24761: HTTP Request Smuggling in waitress. Affects waitress versions < 2.1.1. Fixed in 2.1.1. How to fix ↓
Also tracked for
- waitress · Debian:11
The same CVE-2022-24761 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Waitress is a Python web server that serves web applications. It is designed to be simple and efficient, providing a WSGI-compliant server for hosting Python web applications. However, a vulnerability has been discovered in Waitress that allows for HTTP request smuggling when used behind a proxy that does not properly validate incoming requests. This vulnerability can lead to requests being smuggled to Waitress and potentially result in unauthorized access or other malicious activities.
Vulnerability Detail
The vulnerability arises from two issues. First, Waitress uses Python's int() function to parse strings into integers, but it does not handle certain input correctly. This can lead to parsing errors and allow for smuggling of requests. Second, Waitress does not support chunk extensions and discards them without proper validation. This can be exploited to smuggle requests through the front-end proxy to Waitress. The impact of these vulnerabilities is that requests can be manipulated and smuggled, potentially bypassing security measures and leading to unauthorized access or other malicious activities.
How To Fix
Latest published version: 3.0.2 as of 22 Oct 2026
pip install --upgrade "waitress==3.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.1
This is the first release that contains the fix.
pip install --upgrade "waitress==2.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Waitress is not immediately feasible, a workaround is to ensure that the proxy server in front of Waitress properly validates incoming requests according to the RFC7230 standard. This can help prevent request smuggling. However, it is recommended to upgrade to the latest version of Waitress as soon as possible to fully address the vulnerability.
Conclusion
The vulnerability in Waitress allows for HTTP request smuggling, which can lead to unauthorized access and other malicious activities. It is important to upgrade to the latest version of Waitress (2.1.1) to mitigate this vulnerability. If immediate upgrade is not possible, ensure that the proxy server in front of Waitress properly validates incoming requests. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for waitress →
FAQ
Waitress is a Python web server that serves web applications. It provides a WSGI-compliant server for hosting Python web applications.
HTTP request smuggling is a technique where an attacker manipulates the interaction between a client and a server to bypass security measures or perform unauthorized actions.
This vulnerability occurs due to parsing errors in Waitress when handling certain input and the lack of support for chunk extensions. These issues can be exploited to smuggle requests to Waitress.
The potential consequences of this vulnerability include unauthorized access to sensitive information, bypassing security measures, and performing malicious actions on the server.
To fix this vulnerability, upgrade Waitress to version 2.1.1 or later. This can be done by running the command pip install --upgrade waitress.
References
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
