HTTP Request Smuggling Vulnerability in Waitress
Summary
CVE-2019-16792: HTTP Request Smuggling: Content-Length Sent Twice in Waitress. Affects waitress versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- waitress · Debian:11
The same CVE-2019-16792 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Waitress is a Python web server that serves web applications written in Python. It is designed to be a production-quality server for hosting WSGI applications. Waitress is widely used in the Python ecosystem and is available on PyPI. However, a vulnerability has been discovered in Waitress that allows for HTTP request smuggling.
Vulnerability Detail
The vulnerability in Waitress arises from a header folding issue. When Waitress receives a request with multiple Content-Length headers, it incorrectly combines them into a single header separated by a comma. As a result, Waitress sets the Content-Length to 0 internally. This causes Waitress to treat the request as having no body and interpret the body of the request as a new request in HTTP pipelining. This vulnerability can be exploited by an attacker to bypass security measures and potentially perform unauthorized actions.
How To Fix
Latest published version: 3.0.2 as of 22 Oct 2026
pip install --upgrade "waitress==3.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.0
This is the first release that contains the fix.
pip install --upgrade "waitress==1.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately upgrade to Waitress 1.4.0, you can mitigate the risk by using reverse proxies that have protections against sending potentially bad HTTP requests to the backend. Additionally, if the reverse proxy does not use HTTP/1.1 for connecting to the backend, the impact of this vulnerability is reduced as HTTP pipelining does not exist in HTTP/1.0. However, this is not a foolproof security method.
Conclusion
The HTTP Request Smuggling vulnerability in Waitress can be mitigated by upgrading to version 1.4.0 or later. It is important to validate the changes in Waitress to ensure compatibility with your application. If you have further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for waitress →
FAQ
The vulnerability allows for HTTP request smuggling, which can bypass security measures and potentially lead to unauthorized actions.
Upgrade to Waitress 1.4.0 or later to fix this vulnerability. Validate the changes in Waitress to ensure they do not cause any unintended behavior.
Using reverse proxies with protections against bad HTTP requests can mitigate the risk. Additionally, if the reverse proxy does not use HTTP/1.1, the impact is reduced.
There are no known public exploits of this vulnerability at the time of this advisory.
You can open an issue at the Waitress GitHub repository or email the Pylons Security mailing list for security-related concerns.
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
