CVE-2019-16785: Waitress HTTP Request Smuggling Vulnerability
Summary
CVE-2019-16785: Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a lin... Affects waitress across 2 version ranges.
< 1.4.0
< 8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba
Fixed in 8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba. How to fix ↓
Also tracked for
- waitress · Debian:11
The same CVE-2019-16785 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Waitress is a Python WSGI server that serves web applications. It is designed to be fast and efficient, providing a simple way to serve web applications without the need for complex configuration. Waitress follows the RFC7230 standard for HTTP, which specifies the format and behavior of HTTP messages. However, prior to version 1.4.0, Waitress implemented a part of the RFC7230 in a way that could lead to HTTP request smuggling. This vulnerability allows an attacker to manipulate the interpretation of HTTP messages between the front-end and back-end servers, potentially leading to security breaches and unauthorized access.
Vulnerability Detail
The vulnerability in Waitress arises from its interpretation of line terminators in HTTP messages. According to the RFC7230 standard, a line terminator should be a carriage return followed by a line feed (CRLF). However, Waitress also recognizes a single line feed (LF) as a valid line terminator, ignoring any preceding carriage return (CR). This discrepancy in parsing can be exploited by an attacker to perform HTTP request smuggling or splitting. In this scenario, the front-end server may parse the HTTP message differently from the back-end server, allowing the attacker to send multiple requests that are treated as a single request by the front-end server. This can lead to various security issues, including unauthorized access, data leakage, and potential bypass of security controls.
How To Fix
Latest published version: 3.0.2 as of 22 Oct 2026
pip install --upgrade "waitress==3.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba
This is the first release that contains the fix.
pip install --upgrade "waitress==8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Waitress is not immediately feasible, a temporary workaround can be implemented by configuring the front-end server to parse header fields with a line feed (LF) in the same way as those with a carriage return followed by a line feed (CRLF). This ensures consistent parsing of HTTP messages and reduces the risk of HTTP request smuggling. However, it is strongly recommended to upgrade to the latest version of Waitress as soon as possible to fully address the vulnerability.
Conclusion
The Waitress HTTP Request Smuggling vulnerability (CVE-2019-16785) allows an attacker to manipulate the interpretation of HTTP messages between the front-end and back-end servers, potentially leading to security breaches and unauthorized access. It is crucial to upgrade to Waitress version 1.4.0 or later to fix this vulnerability. In the meantime, configuring the front-end server to parse header fields consistently can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for waitress →
FAQ
HTTP request smuggling is a technique used by attackers to manipulate the interpretation of HTTP messages between a front-end server and a back-end server. By exploiting discrepancies in how the servers parse and interpret these messages, an attacker can send malicious requests that are treated differently by each server, potentially bypassing security controls and gaining unauthorized access.
This vulnerability affects Waitress versions prior to 1.4.0. It allows an attacker to perform HTTP request smuggling, manipulating the interpretation of HTTP messages between the front-end and back-end servers. This can lead to security breaches, unauthorized access, and potential bypass of security controls.
HTTP request smuggling can have various consequences, including unauthorized access to sensitive information, data leakage, and potential bypass of security controls. By manipulating the interpretation of HTTP messages, an attacker can exploit vulnerabilities in the application or infrastructure, potentially leading to further compromise.
You can use Vulert's vulnerability playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file to provide accurate vulnerability information without requiring access to the code or installation.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability in Waitress. However, it is important to promptly address this vulnerability by upgrading to the latest version of Waitress to mitigate the risk of potential exploits.
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
