CVE-2019-16792: Waitress Content-Length Header Smuggling
Summary
CVE-2019-16792: Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Affects waitress across 2 version ranges.
< 1.4.0
< 575994cd42e83fd772a5f7ec98b2c56751bd3f65
Fixed in 575994cd42e83fd772a5f7ec98b2c56751bd3f65. How to fix ↓
Also tracked for
- waitress · Debian:11
The same CVE-2019-16792 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Waitress is a Python WSGI server that serves web applications. It is designed to be fast, efficient, and easy to use. Waitress handles HTTP requests and responses, allowing developers to build and deploy web applications. However, versions up to 1.3.1 are vulnerable to a Content-Length header smuggling attack.
Vulnerability Detail
The vulnerability in Waitress arises when the Content-Length header is sent twice in a single request. Waitress incorrectly handles this situation by folding the double Content-Length header and setting the Content-Length to 0 internally. As a result, if two Content-Length headers are included in a request, Waitress treats the request as having no body. This behavior can be exploited in HTTP pipelining, where the body of the request is treated as a new request. The vulnerability can lead to request smuggling attacks, potentially allowing an attacker to bypass security measures and perform unauthorized actions.
How To Fix
Latest published version: 3.0.2 as of 22 Oct 2026
pip install --upgrade "waitress==3.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
575994cd42e83fd772a5f7ec98b2c56751bd3f65
This is the first release that contains the fix.
pip install --upgrade "waitress==575994cd42e83fd772a5f7ec98b2c56751bd3f65"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to Waitress version 1.4.0 or later.
Conclusion
Waitress versions up to 1.3.1 are vulnerable to a Content-Length header smuggling attack. This vulnerability can be exploited to perform request smuggling and potentially bypass security measures. To address the issue, users should upgrade to Waitress version 1.4.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for waitress →
FAQ
Waitress is a Python WSGI server that serves web applications. It is designed to be fast, efficient, and easy to use.
The Content-Length header is an HTTP header that specifies the length of the request or response body in bytes.
Request smuggling is a technique where an attacker manipulates the way a web server processes HTTP requests, potentially bypassing security measures and performing unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for open-source vulnerabilities, including this one.
Yes, the vulnerability has been fixed in Waitress version 1.4.0. It is recommended to upgrade to this version or later to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for waitress.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
