CVE-2019-16789: HTTP Request Smuggling in Waitress
Summary
CVE-2019-16789: HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up). Affects waitress versions < 1.4.2. Fixed in 1.4.2. How to fix ↓
Also tracked for
- waitress · Debian:11
The same CVE-2019-16789 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Waitress is a Python web server that serves web applications written using the WSGI specification. It is commonly used in Python web frameworks such as Pyramid and Flask. This vulnerability in Waitress allows an attacker to smuggle requests or split a HTTP request with invalid data, even after previous patches were applied. The issue can have serious security implications and should be addressed promptly.
Vulnerability Detail
The vulnerability arises from the improper handling of whitespace characters in HTTP headers. By exploiting this flaw, an attacker can manipulate the headers to smuggle requests or split a HTTP request, potentially bypassing security measures or causing unexpected behavior. The impact of this vulnerability can range from information disclosure to remote code execution, depending on the specific context in which Waitress is used.
How To Fix
Latest published version: 3.0.2 as of 22 Oct 2026
pip install --upgrade "waitress==3.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.2
This is the first release that contains the fix.
pip install --upgrade "waitress==1.4.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to upgrade to Waitress 1.4.2 to address the issue.
Conclusion
The HTTP Request Smuggling vulnerability in Waitress (CVE-2019-16789) can have serious security implications. It is crucial to upgrade to Waitress 1.4.2 to mitigate the issue. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for waitress →
FAQ
The impact can vary depending on the specific context, but it can range from information disclosure to remote code execution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it in real-time.
No, there are no known workarounds for this vulnerability. Upgrading to Waitress 1.4.2 is the recommended solution.
Versions prior to 1.4.2 are affected by this vulnerability.
You can refer to the official GitHub advisory for more details: https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4
References
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
