CVE-2019-16786: Vulnerability in Waitress
Summary
CVE-2019-16786: Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. Affects waitress across 2 version ranges.
< 1.3.1
< f11093a6b3240fc26830b6111e826128af7771c3
Fixed in f11093a6b3240fc26830b6111e826128af7771c3. How to fix ↓
Also tracked for
- waitress · Debian:11
The same CVE-2019-16786 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Waitress is a Python WSGI server that serves web applications. It is designed to be fast and efficient, making it a popular choice for hosting Python web applications. However, versions up to 1.3.1 of Waitress have a vulnerability that could allow for HTTP pipelining attacks.
Vulnerability Detail
Waitress versions up to 1.3.1 incorrectly parse the Transfer-Encoding header in HTTP requests. Instead of treating it as a comma-separated list of encoding values, Waitress only looks for a single string value. If the value is not 'chunked', Waitress falls back to using the Content-Length header. This can lead to a single request being treated as multiple requests in the case of HTTP pipelining, potentially causing unexpected behavior or security issues.
How To Fix
Latest published version: 3.0.2 as of 22 Oct 2026
pip install --upgrade "waitress==3.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
f11093a6b3240fc26830b6111e826128af7771c3
This is the first release that contains the fix.
pip install --upgrade "waitress==f11093a6b3240fc26830b6111e826128af7771c3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Waitress as soon as possible.
Conclusion
Waitress versions up to 1.3.1 have a vulnerability that can be exploited through HTTP pipelining. To mitigate this vulnerability, it is important to upgrade to Waitress version 1.4.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for waitress →
FAQ
Waitress is a Python WSGI server that serves web applications.
HTTP pipelining is a technique that allows multiple HTTP requests to be sent on a single TCP connection without waiting for the responses. This can improve performance by reducing the overhead of establishing and tearing down TCP connections for each request.
This vulnerability in Waitress allows for HTTP pipelining attacks, where a single request can be treated as multiple requests. This can lead to unexpected behavior or security issues.
To fix this vulnerability, you should upgrade to Waitress version 1.4.0 or later.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Waitress.
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
