{"id":"CVE-2024-49768","aliases":["AZL-57396","CLSA-2025-1750810247","DEBIAN-CVE-2024-49768","EUVD-2024-0187","GHSA-9298-4cf8-g4wj","MGASA-2025-0053","OESA-2024-2333","OESA-2024-2334","OESA-2024-2335","OESA-2024-2336","PYSEC-2024-210","RHSA-2024:10145","RHSA-2024:10535","RHSA-2024:10815","RHSA-2024:9613","RHSA-2024:9618","RHSA-2024:9623","RHSA-2025:0201","RHSA-2025:1191","RHSA-2025:1192","SUSE-SU-2024:3876-1","UBUNTU-CVE-2024-49768","USN-7115-1"],"status":"published","title":"Waitress has request processing race condition in HTTP pipelining with invalid first request","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00486,"percentile":0.42147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367","CWE-444"],"published":"2024-10-29T14:32:25Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"PyPI","package":"waitress","fixed_in":["3.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"waitress","fixed_in":["2.1.2.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"waitress","fixed_in":["2.1.2-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"waitress","fixed_in":["3.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"waitress","fixed_in":["3.0.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-waitress","fixed_in":["2.0.0-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-waitress","fixed_in":["2.0.0-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-waitress","fixed_in":["2.1.2-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-waitress","fixed_in":["2.0.0-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"waitress","fixed_in":["2.1.2-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2"},{"fixed":"2.1.2.post1+tuxcare"}]}],"versions":["2.1.2"]},{"source":"osv","ecosystem":"Debian:12","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-2+deb12u1"}]}],"versions":["2.1.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"3.0.1"}]}],"versions":["2.0.0","2.1.0","2.1.0b0","2.1.1","2.1.2","3.0.0"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"waitress","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"e4359018537af376cf24bd13616d861e2fb76f65"}]},{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"3.0.1"}]}],"versions":["2.0.0","2.1.0","2.1.0b0","2.1.1","2.1.2","3.0.0"]},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.15::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.15::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.13::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.13::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.17::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.17::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.16::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.16::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.14::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.14::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el9ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el9ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-2ubuntu0.1~esm1"}]}],"versions":["2.1.2-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1ubuntu0.2"}]}],"versions":["1.2.0~b2-2","1.3.1-4","1.4.1-1","1.4.1-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.1ubuntu1.1"}]}],"versions":["1.4.4-1.1","1.4.4-1.1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-2ubuntu0.1~esm1"}]}],"versions":["2.1.2-2"],"bundled":2}],"products":[{"vendor":"agendaless","product":"waitress"},{"vendor":"pylons","product":"waitress"}],"references":[{"url":"https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49768","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2024-210.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9298-4cf8-g4wj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49768.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-49768","tags":["advisory"]},{"url":"https://github.com/Pylons/waitress","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0053.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33819","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2024-November/019754.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2333","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2334","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2335","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2336","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10145","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2322460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2322461","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10145.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-49768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49768","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-49769","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49769","tags":["advisory"]},{"url":"https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95c","tags":["article"]},{"url":"https://github.com/Pylons/waitress/issues/418","tags":["article"]},{"url":"https://github.com/Pylons/waitress/pull/435","tags":["article"]},{"url":"https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10535","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10535.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10815","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10815.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9613","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9613.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9618","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9618.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9623","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9623.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0201","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0201.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1191","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1191.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1192","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1192.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243876-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232554","tags":["report"]},{"url":"https://bugzilla.suse.com/1232556","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49769","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-49768","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7115-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-49769","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-49768","title":"Waitress has request processing race condition in HTTP pipelining with invalid first request","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.","status":"published","published":"2024-10-29T14:32:25.164Z","modified":"2024-10-29T14:56:02.111Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-367","CWE-444"],"updated_at":"2026-11-02T14:33:55.977982Z"}],"euvd":[{"id":"EUVD-2024-0187","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.","status":"published","published":"2024-10-29T14:32:25Z","modified":"2024-10-29T14:56:02Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T00:05:15.24326Z"}],"ghsa":[{"id":"GHSA-9298-4cf8-g4wj","title":"Waitress has request processing race condition in HTTP pipelining with invalid first request","description":"### Impact\n\nA remote client may send a request that is exactly `recv_bytes` (defaults to 8192) long, followed by a secondary request using HTTP pipelining.\n\nWhen request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection.\n\nHowever when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed.\n\n### Patches\n\nWaitress 3.0.1 fixes the race condition.\n\n### Workarounds\n\nDisable  `channel_request_lookahead`, this is set to `0` by default disabling this feature. For this vulnerability this value is required to be changed from the default.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/Pylons/waitress/issues (if not sensitive or security related)\n* email the Pylons Security mailing list: [pylons-project-security@googlegroups.com](mailto:pylons-project-security@googlegroups.com) (if security related)\n\n### Thanks\n\n- m4yfly and urn1ce From TianGong Team of Legendsec at Qi'anxin Group.","status":"published","published":"2024-10-29T14:45:03Z","modified":"2025-01-21T17:53:26Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-367","CWE-444"],"updated_at":"2026-11-02T14:38:27.974809Z"}],"nvd":[{"id":"CVE-2024-49768","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.","status":"published","published":"2024-10-29T15:15:11.44Z","modified":"2026-06-17T08:00:24.767Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-367","CWE-444"],"updated_at":"2026-11-02T14:10:35.289159Z"}],"osv":[{"id":"AZL-57396","title":"CVE-2024-49768 affecting package python-waitress 3.0.1-1","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.","status":"published","published":"2024-10-29T15:15:11Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"CVE-2024-49768","title":"Waitress has request processing race condition in HTTP pipelining with invalid first request","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.","status":"published","published":"2024-10-29T14:32:25.164Z","modified":"2026-10-28T02:30:35.493334844Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-367","CWE-444"],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"DEBIAN-CVE-2024-49768","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.","status":"published","published":"2024-10-29T15:15:11.44Z","modified":"2026-11-02T12:02:53.176806024Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"GHSA-9298-4cf8-g4wj","title":"Waitress has request processing race condition in HTTP pipelining with invalid first request","description":"### Impact\n\nA remote client may send a request that is exactly `recv_bytes` (defaults to 8192) long, followed by a secondary request using HTTP pipelining.\n\nWhen request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection.\n\nHowever when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed.\n\n### Patches\n\nWaitress 3.0.1 fixes the race condition.\n\n### Workarounds\n\nDisable  `channel_request_lookahead`, this is set to `0` by default disabling this feature. For this vulnerability this value is required to be changed from the default.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/Pylons/waitress/issues (if not sensitive or security related)\n* email the Pylons Security mailing list: [pylons-project-security@googlegroups.com](mailto:pylons-project-security@googlegroups.com) (if security related)\n\n### Thanks\n\n- m4yfly and urn1ce From TianGong Team of Legendsec at Qi'anxin Group.","status":"published","published":"2024-10-29T14:45:03Z","modified":"2025-01-21T18:22:46.807383Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-367","CWE-444"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"OESA-2024-2333","title":"python-waitress security update","description":"Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.7+ and Python 3.5+. It is also known to run on PyPy 1.6.0+ on UNIX. It supports HTTP/1.0 and HTTP/1.1.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-49768)","status":"published","published":"2024-11-01T11:07:48Z","modified":"2026-08-18T01:17:36.443989786Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2334","title":"python-waitress security update","description":"Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.7+ and Python 3.5+. It is also known to run on PyPy 1.6.0+ on UNIX. It supports HTTP/1.0 and HTTP/1.1.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-49768)","status":"published","published":"2024-11-01T11:07:48Z","modified":"2026-08-18T01:18:37.682090439Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2335","title":"python-waitress security update","description":"Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.7+ and Python 3.5+. It is also known to run on PyPy 1.6.0+ on UNIX. It supports HTTP/1.0 and HTTP/1.1.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-49768)","status":"published","published":"2024-11-01T11:07:48Z","modified":"2026-08-18T01:17:36.530953815Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2336","title":"python-waitress security update","description":"Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.7+ and Python 3.5+. It is also known to run on PyPy 1.6.0+ on UNIX. It supports HTTP/1.0 and HTTP/1.1.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-49768)","status":"published","published":"2024-11-01T11:07:48Z","modified":"2026-08-18T01:18:37.723912728Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"PYSEC-2024-210","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.","status":"published","published":"2024-10-29T15:15:11Z","modified":"2025-01-19T19:56:46.402896Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"RHSA-2024:10145","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.39 packages and security update","status":"published","published":"2024-11-26T13:00:08Z","modified":"2026-07-03T10:04:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:10535","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.70 security update","status":"published","published":"2024-12-05T10:02:28Z","modified":"2026-07-03T10:04:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:10815","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.54 packages and security update","status":"published","published":"2024-12-12T10:02:15Z","modified":"2026-07-03T10:04:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:9613","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.5 security update","status":"published","published":"2024-11-25T09:51:35Z","modified":"2026-07-03T10:06:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2024:9618","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.23 packages and security update","status":"published","published":"2024-11-25T09:52:05Z","modified":"2026-07-03T10:06:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2024:9623","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.41 packages and security update","status":"published","published":"2024-11-25T09:52:15Z","modified":"2026-07-03T10:06:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0201","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-waitress) security update","status":"published","published":"2025-01-10T10:02:57Z","modified":"2026-07-03T10:06:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:1191","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-waitress) security update","status":"published","published":"2025-02-10T10:02:55Z","modified":"2026-07-03T10:06:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:1192","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-waitress) security update","status":"published","published":"2025-02-10T10:02:56Z","modified":"2026-07-03T10:06:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"UBUNTU-CVE-2024-49768","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.","status":"published","published":"2024-10-29T15:15:00Z","modified":"2026-02-04T03:39:33.041768Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"CLSA-2025-1750810247","title":"TuxCare security update for waitress (1 CVE)","description":"TuxCare rebuilt waitress to address 1 CVE. Fixed in 2.1.2.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:46:27.822090585Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"MGASA-2025-0053","title":"Updated python-waitress packages fix security vulnerabilities","description":"Waitress has a request processing race condition in HTTP pipelining with\nan invalid first request. (CVE-2024-49768)\nWaitress has a denial of service leading to high CPU usage/resource\nexhaustion. (CVE-2024-49769)\n","status":"published","published":"2025-02-12T06:37:33Z","modified":"2026-04-16T04:43:57.643400698Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"SUSE-SU-2024:3876-1","title":"Security update for python-waitress","description":"This update for python-waitress fixes the following issues:\n\n- CVE-2024-49768: Fixed request processing race condition in HTTP pipelining with invalid first request when lookahead is enabled (bsc#1232556)\n- CVE-2024-49769: Fixed incorrect connection clean up leads to a busy-loop and resource exhaustion (bsc#1232554)\n","status":"published","published":"2024-11-01T15:29:32Z","modified":"2026-02-04T04:16:49.563209Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-7115-1","title":"Waitress vulnerabilities","description":"It was discovered that Waitress could process follow up requests when\nreceiving a specially crafted message. An attacker could use this issue to\nhave the server process inconsistent client requests. This issue only\naffected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-49768)\n\nDylan Jay discovered that Waitress could be lead to write to an unexisting\nsocket after closing the remote connection. An attacker could use this\nissue to increase resource utilization leading to a denial of service.\n(CVE-2024-49769)\n","status":"published","published":"2024-11-19T17:19:55Z","modified":"2026-04-27T17:34:39.561883Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}