CVE-2019-16786: HTTP Request Smuggling in Waitress
Summary
CVE-2019-16786: HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress. Affects waitress versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- waitress · Debian:11
The same CVE-2019-16786 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Waitress is a Python web server that serves web applications written in Python. It is designed to be efficient and easy to use. Waitress parses HTTP requests and handles the transfer of data between the client and the server. However, it was found that Waitress did not properly handle the Transfer-Encoding header, allowing for potential HTTP request smuggling attacks.
Vulnerability Detail
The vulnerability in Waitress arises from its incorrect parsing of the Transfer-Encoding header. According to the HTTP standard, Transfer-Encoding should be a comma-separated list of encoding values, with chunked being the last element. However, Waitress only looked for a single string value and ignored any additional encodings. This could lead to the server treating a single request as multiple requests, potentially allowing for HTTP request smuggling attacks. An attacker could exploit this vulnerability to bypass security measures or perform other malicious activities.
How To Fix
Latest published version: 3.0.2 as of 22 Oct 2026
pip install --upgrade "waitress==3.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.0
This is the first release that contains the fix.
pip install --upgrade "waitress==1.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Waitress is not immediately feasible, using a reverse proxy that has protections against sending potentially bad HTTP requests to the backend can provide some mitigation. Additionally, ensuring that the reverse proxy uses HTTP/1.1 for connecting to the backend can help as HTTP pipelining does not exist in HTTP/1.0. However, this is not a foolproof security method and upgrading to the latest version of Waitress is still recommended.
Conclusion
The vulnerability in Waitress that allows for HTTP request smuggling can be mitigated by upgrading to version 1.4.0 or later. It is important to promptly apply the recommended fix to ensure the security and integrity of web applications served by Waitress. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for waitress →
FAQ
Waitress is a Python web server that serves web applications written in Python. It is designed to be efficient and easy to use.
HTTP request smuggling is a technique where an attacker manipulates the way a web server processes HTTP requests, leading to security vulnerabilities such as bypassing security measures or performing unauthorized actions.
An attacker can exploit this vulnerability by sending specially crafted HTTP requests with an invalid Transfer-Encoding header. This can trick Waitress into treating a single request as multiple requests, potentially bypassing security measures or causing other issues.
The impact of this vulnerability can vary depending on the specific application and server setup. It could potentially allow an attacker to bypass security measures, perform unauthorized actions, or cause other issues by manipulating the way Waitress processes HTTP requests.
The recommended mitigation is to upgrade to Waitress version 1.4.0 or later. This version includes fixes to handle potential HTTP request confusions and enforces stricter adherence to the HTTP standard. Using a reverse proxy with protections against bad HTTP requests can also provide some mitigation.
References
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
