CVE-2020-5236: Catastrophic backtracking in regex allows Denial of Service in Waitress
Summary
CVE-2020-5236: Catastrophic backtracking in regex allows Denial of Service in Waitress. Affects waitress versions >= 1.4.2, < 1.4.3. Fixed in 1.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Waitress is a Python web server that serves web applications. It is designed to be fast, efficient, and easy to use. The vulnerability in Waitress version 1.4.2 allows for a Denial of Service (DoS) attack when receiving a header with invalid characters. This causes the regular expression engine to catastrophically backtrack, consuming 100% CPU time and blocking other interactions. An attacker can exploit this vulnerability by sending a single request with an invalid header, effectively taking the service offline. The issue was introduced in version 1.4.2 when the regular expression was updated to match the behavior required by errata associated with RFC7230.
Vulnerability Detail
The vulnerability in Waitress version 1.4.2 allows for a DoS attack by exploiting a catastrophic backtracking issue in the regular expression used to validate incoming headers. When an invalid header with excessive characters is received, the regular expression engine enters a state of catastrophic backtracking, causing the process to consume 100% CPU time and blocking other interactions. This allows an attacker to send a single request with an invalid header and effectively take the service offline. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 5.7.
How To Fix
Latest published version: 3.0.2 as of 22 Oct 2026
pip install --upgrade "waitress==3.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.3
This is the first release that contains the fix.
pip install --upgrade "waitress==1.4.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you have deployed a reverse proxy in front of Waitress, it may already be rejecting requests that include invalid headers. This can serve as a workaround to mitigate the vulnerability. However, it is still recommended to upgrade to the latest version of Waitress to ensure complete protection.
Conclusion
The vulnerability in Waitress version 1.4.2 allows for a Denial of Service (DoS) attack by exploiting a catastrophic backtracking issue in the regular expression used to validate incoming headers. To mitigate this vulnerability, it is recommended to upgrade to version 1.4.3 of Waitress, which includes a patch for the issue. If you have deployed a reverse proxy in front of Waitress, it may already be rejecting requests with invalid headers, providing a partial workaround. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for waitress →
FAQ
The vulnerability allows an attacker to send a single request with an invalid header, causing the Waitress server to consume 100% CPU time and block other interactions. This effectively takes the service offline, resulting in a Denial of Service (DoS) attack.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
The recommended solution is to upgrade to version 1.4.3 of Waitress. This version includes a patch for the vulnerability by updating the regular expression used to validate incoming headers.
If you have deployed a reverse proxy in front of Waitress, it may already be rejecting requests with invalid headers, serving as a workaround to mitigate the vulnerability. However, upgrading to the latest version of Waitress is still recommended for complete protection.
The vulnerability was discovered and disclosed by Fil Zembowicz, who reached out to the Pylons Project with the findings.
References
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
