CVE-2019-16789: Waitress HTTP Request Smuggling Vulnerability
Summary
CVE-2019-16789: In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential fo... Affects waitress across 2 version ranges.
< 1.4.1
< 11d9e138125ad46e951027184b13242a3c1de017
Fixed in 11d9e138125ad46e951027184b13242a3c1de017. How to fix ↓
Also tracked for
- waitress · Debian:11
The same CVE-2019-16789 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Waitress is a pure-Python WSGI server that is designed to be small and efficient. It is commonly used as a production server for web applications written in Python. Waitress is responsible for handling incoming HTTP requests and forwarding them to the appropriate application. However, versions up to 1.4.0 are vulnerable to an HTTP request smuggling attack when used behind a proxy server.
Vulnerability Detail
The vulnerability in Waitress arises when an attacker sends an invalid request that bypasses the front-end proxy server and is parsed differently by Waitress. This can occur when specially crafted requests contain special whitespace characters in the Transfer-Encoding header. Waitress mistakenly interprets these requests as chunked requests, while a front-end server would consider the Transfer-Encoding header as invalid due to the presence of invalid characters. If a front-end server uses HTTP pipelining to a backend Waitress server, this can lead to HTTP request splitting, potentially resulting in cache poisoning or unexpected information disclosure.
How To Fix
Latest published version: 3.0.2 as of 22 Oct 2026
pip install --upgrade "waitress==3.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11d9e138125ad46e951027184b13242a3c1de017
This is the first release that contains the fix.
pip install --upgrade "waitress==11d9e138125ad46e951027184b13242a3c1de017"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to apply the fix by upgrading to Waitress 1.4.1 or later.
Conclusion
The vulnerability in Waitress versions up to 1.4.0 allows for potential HTTP request smuggling, which can lead to cache poisoning or unexpected information disclosure. Users are advised to upgrade to Waitress 1.4.1 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for waitress →
FAQ
Waitress is a pure-Python WSGI server that is commonly used as a production server for web applications written in Python.
HTTP request smuggling is a technique where an attacker manipulates the way a web server parses and interprets HTTP requests, potentially bypassing security measures or causing unexpected behavior.
The vulnerability in Waitress occurs when an attacker sends an invalid request that bypasses the front-end proxy server and is parsed differently by Waitress, leading to potential HTTP request smuggling.
The potential consequences of this vulnerability include cache poisoning and unexpected information disclosure, which can have serious security implications for affected systems.
To fix the vulnerability, upgrade to Waitress version 1.4.1 or later and restart any services or applications that rely on Waitress.
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
