CVE-2019-16785: HTTP Request Smuggling in Waitress
Summary
CVE-2019-16785: HTTP Request Smuggling: LF vs CRLF handling in Waitress. Affects waitress versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- waitress · Debian:11
The same CVE-2019-16785 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Waitress is a Python web server that serves WSGI applications. It is designed to be fast, efficient, and easy to use. However, it is vulnerable to HTTP request smuggling due to a mishandling of LF and CRLF line terminators. This vulnerability can allow attackers to split HTTP requests and potentially smuggle a second request within the body of the first.
Vulnerability Detail
Waitress implemented a non-standard behavior specified in RFC7230, which allows it to recognize a single LF as a line terminator and ignore any preceding CR. This can lead to a discrepancy between how the front-end server and Waitress parse the same HTTP message. Attackers can exploit this by sending a specially crafted request that Waitress interprets differently from the front-end server, potentially allowing them to smuggle a second request within the first. This can lead to various security risks, including unauthorized access, data leakage, and remote code execution.
How To Fix
Latest published version: 3.0.2 as of 22 Oct 2026
pip install --upgrade "waitress==3.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.0
This is the first release that contains the fix.
pip install --upgrade "waitress==1.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If using a reverse proxy, ensure that it has protections against sending potentially bad HTTP requests to the backend. Additionally, using HTTP/1.0 instead of HTTP/1.1 can mitigate the issue to some extent, as HTTP pipelining does not exist in HTTP/1.0. However, this is not a foolproof security method.
Conclusion
Waitress is vulnerable to HTTP request smuggling due to a mishandling of LF and CRLF line terminators. This can allow attackers to manipulate the parsing of HTTP messages and potentially smuggle a second request within the first. The vulnerability is fixed in Waitress 1.4.0, and it is recommended to upgrade to this version or later to mitigate the issue. Using a reverse proxy with protections and HTTP/1.0 instead of HTTP/1.1 can provide some additional mitigation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for waitress →
FAQ
Waitress is a Python web server that serves WSGI applications. It is known for its speed, efficiency, and ease of use.
HTTP request smuggling is a technique where an attacker manipulates the way a front-end server and a back-end server parse the same HTTP message, potentially allowing them to smuggle a second request within the first.
This vulnerability in Waitress can lead to HTTP request smuggling, which can have various security implications, including unauthorized access, data leakage, and remote code execution.
To fix this vulnerability, upgrade to Waitress 1.4.0 or later. This version ensures that all lines are terminated correctly with CRLF and rejects requests with bare CR or LF.
Using a reverse proxy with protections against bad HTTP requests and using HTTP/1.0 instead of HTTP/1.1 can provide some mitigation. However, upgrading to the fixed version of Waitress is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
