{"id":"CVE-2024-49769","aliases":["AZL-51822","AZL-51831","CLSA-2025-1750810248","DEBIAN-CVE-2024-49769","DLA-3955-1","EUVD-2024-0188","GHSA-3f84-rpwh-47g6","MGASA-2025-0053","OESA-2024-2374","OESA-2024-2375","OESA-2024-2376","OESA-2024-2377","OESA-2025-1436","PYSEC-2024-211","RHSA-2024:10145","RHSA-2024:10535","RHSA-2024:10815","RHSA-2024:9613","RHSA-2024:9618","RHSA-2024:9623","RHSA-2025:0201","RHSA-2025:1191","RHSA-2025:1192","SUSE-SU-2024:3876-1","SUSE-SU-2024:4107-1","UBUNTU-CVE-2024-49769","USN-7115-1","openSUSE-SU-2024:14445-1","openSUSE-SU-2026:12047-1"],"status":"published","title":"Waitress has a denial of service leading to high CPU usage/resource exhaustion","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01377,"percentile":0.7229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-772"],"published":"2024-10-29T14:18:40Z","modified":"2026-11-02T12:03:04Z","fixes":[{"ecosystem":"PyPI","package":"waitress","fixed_in":["3.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"python-waitress","fixed_in":["3.0.1-1"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"waitress","fixed_in":["2.1.2.post2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"waitress","fixed_in":["2.1.2-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"waitress","fixed_in":["3.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"waitress","fixed_in":["3.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"waitress","fixed_in":["1.4.4-1.1+deb11u2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-waitress","fixed_in":["2.0.0-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-waitress","fixed_in":["2.0.0-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-waitress","fixed_in":["2.0.0-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-waitress","fixed_in":["2.1.2-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-waitress","fixed_in":["1.4.4-1.oe2003sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-waitress","fixed_in":["1.4.3-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"waitress","fixed_in":["1.4.1-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"waitress","fixed_in":["1.4.4-1.1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"waitress","fixed_in":["2.1.2-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-waitress","fixed_in":["3.0.1-1.1","3.0.2-1.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.4-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2"},{"fixed":"2.1.2.post2+tuxcare"}]}],"versions":["2.1.2","2.1.2.post1+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-2+deb12u1"}]}],"versions":["2.1.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.1+deb11u2"}]}],"versions":["1.4.4-1.1","1.4.4-1.1+deb11u1"]},{"source":"osv","ecosystem":"PyPI","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}],"versions":["0.1","0.2","0.3","0.4","0.5","0.6","0.6.1","0.7","0.8","0.8.1","0.8.10","0.8.11b0","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9.0","0.9.0b0","0.9.0b1","1.0.0","1.0.1","1.0.2","1.0a1","1.0a2","1.1.0","1.2.0","1.2.0b1","1.2.0b2","1.2.0b3","1.2.1","1.3.0","1.3.0b0","1.3.1","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","2.0.0","2.0.0b0","2.0.0b1","2.1.0","2.1.0b0","2.1.1","2.1.2","3.0.0"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"waitress","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"1ae4e894c9f76543bee06584001583fc6fa8c95c"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}],"versions":["0.1","0.2","0.3","0.4","0.5","0.6","0.6.1","0.7","0.8","0.8.1","0.8.10","0.8.11b0","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9.0","0.9.0b0","0.9.0b1","1.0.0","1.0.1","1.0.2","1.0a1","1.0a2","1.1.0","1.2.0","1.2.0b1","1.2.0b2","1.2.0b3","1.2.1","1.3.0","1.3.0b0","1.3.1","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","2.0.0","2.0.0b0","2.0.0b1","2.1.0","2.1.0b0","2.1.1","2.1.2","3.0.0"]},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.15::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.15::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.13::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.13::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.17::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.17::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.16::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.16::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.14::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.14::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el9ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el9ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-4.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-waitress-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150400.12.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.9-2ubuntu1","0.8.10-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1ubuntu0.2"}]}],"versions":["1.2.0~b2-2","1.3.1-4","1.4.1-1","1.4.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.1ubuntu1.1"}]}],"versions":["1.4.4-1.1","1.4.4-1.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-2ubuntu0.1~esm1"}]}],"versions":["2.1.2-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1ubuntu0.2"}]}],"versions":["1.2.0~b2-2","1.3.1-4","1.4.1-1","1.4.1-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.1ubuntu1.1"}]}],"versions":["1.4.4-1.1","1.4.4-1.1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-2ubuntu0.1~esm1"}]}],"versions":["2.1.2-2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-1.7"}]}]}],"products":[{"vendor":"agendaless","product":"waitress"},{"vendor":"pylons","product":"waitress"}],"references":[{"url":"https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/Pylons/waitress/issues/418","tags":["x_refsource_MISC","Issue Tracking","report","web","article"]},{"url":"https://github.com/Pylons/waitress/pull/435","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95c","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00012.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49769","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2024-211.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3f84-rpwh-47g6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49769.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-49769","tags":["advisory"]},{"url":"https://github.com/Pylons/waitress","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0053.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33819","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2024-November/019754.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2374","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2375","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2376","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2377","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1436","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10145","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2322460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2322461","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10145.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-49768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49768","tags":["advisory"]},{"url":"https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65","tags":["article"]},{"url":"https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-49769","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49769","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10535","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10535.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10815","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10815.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9613","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9613.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9618","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9618.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9623","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9623.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0201","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0201.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1191","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1191.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1192","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1192.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243876-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232554","tags":["report"]},{"url":"https://bugzilla.suse.com/1232556","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49769","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244107-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-49769","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7115-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-49768","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/A356AQU33LUFWIQZP3F36QKGASAOCNHM/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-49769","title":"Waitress has a denial of service leading to high CPU usage/resource exhaustion","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.","status":"published","published":"2024-10-29T14:18:40.951Z","modified":"2024-11-17T00:11:26.954Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:33:56.402064Z"}],"euvd":[{"id":"EUVD-2024-0188","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.","status":"published","published":"2024-10-29T14:18:40Z","modified":"2024-11-17T00:11:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:57.661321Z"}],"ghsa":[{"id":"GHSA-3f84-rpwh-47g6","title":"Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion","description":"### Impact\n\nWhen a remote client closes the connection before waitress has had the opportunity to call `getpeername()` waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function.\n\nA remote attacker could run waitress out of available sockets with very little resources required.\n\n### Patches\n\nWaitress 3.0.1 contains fixes that remove the race condition.\n\n### Workarounds\n\nNo work-around.\n\n### References\n\n- https://github.com/Pylons/waitress/issues/418\n- https://github.com/Pylons/waitress/pull/435\n","status":"published","published":"2024-10-29T14:33:00Z","modified":"2025-01-21T17:53:28Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:38:27.974809Z"}],"nvd":[{"id":"CVE-2024-49769","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.","status":"published","published":"2024-10-29T15:15:12.03Z","modified":"2026-06-17T08:00:24.887Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:10:35.289159Z"}],"osv":[{"id":"AZL-51822","title":"CVE-2024-49769 affecting package python-waitress 1.4.4-7","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.","status":"published","published":"2024-10-29T15:15:12Z","modified":"2026-04-21T04:33:16.052781Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.3228Z"},{"id":"AZL-51831","title":"CVE-2024-49769 affecting package python-waitress for versions less than 3.0.1-1","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.","status":"published","published":"2024-10-29T15:15:12Z","modified":"2026-04-21T04:53:38.646382Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.3228Z"},{"id":"CVE-2024-49769","title":"Waitress has a denial of service leading to high CPU usage/resource exhaustion","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.","status":"published","published":"2024-10-29T14:18:40.951Z","modified":"2026-10-28T02:31:08.006373812Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"DEBIAN-CVE-2024-49769","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.","status":"published","published":"2024-10-29T15:15:12.03Z","modified":"2026-11-02T12:03:04.22184292Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"GHSA-3f84-rpwh-47g6","title":"Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion","description":"### Impact\n\nWhen a remote client closes the connection before waitress has had the opportunity to call `getpeername()` waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function.\n\nA remote attacker could run waitress out of available sockets with very little resources required.\n\n### Patches\n\nWaitress 3.0.1 contains fixes that remove the race condition.\n\n### Workarounds\n\nNo work-around.\n\n### References\n\n- https://github.com/Pylons/waitress/issues/418\n- https://github.com/Pylons/waitress/pull/435\n","status":"published","published":"2024-10-29T14:33:00Z","modified":"2025-01-21T18:19:46.257061Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"OESA-2024-2374","title":"python-waitress security update","description":"Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.7+ and Python 3.5+. It is also known to run on PyPy 1.6.0+ on UNIX. It supports HTTP/1.0 and HTTP/1.1.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-49769)","status":"published","published":"2024-11-08T11:07:51Z","modified":"2026-08-18T01:18:28.934829769Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2375","title":"python-waitress security update","description":"Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.7+ and Python 3.5+. It is also known to run on PyPy 1.6.0+ on UNIX. It supports HTTP/1.0 and HTTP/1.1.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-49769)","status":"published","published":"2024-11-08T11:07:51Z","modified":"2026-08-18T01:18:28.947936099Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2376","title":"python-waitress security update","description":"Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.7+ and Python 3.5+. It is also known to run on PyPy 1.6.0+ on UNIX. It supports HTTP/1.0 and HTTP/1.1.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-49769)","status":"published","published":"2024-11-08T11:07:51Z","modified":"2026-08-18T01:18:28.972026002Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2377","title":"python-waitress security update","description":"Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.7+ and Python 3.5+. It is also known to run on PyPy 1.6.0+ on UNIX. It supports HTTP/1.0 and HTTP/1.1.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-49769)","status":"published","published":"2024-11-08T11:07:51Z","modified":"2026-08-18T01:18:34.659951574Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1436","title":"python-waitress security update","description":"Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.7+ and Python 3.5+. It is also known to run on PyPy 1.6.0+ on UNIX. It supports HTTP/1.0 and HTTP/1.1.\r\n\r\nSecurity Fix(es):\n\nWaitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won\u0026apos;t correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.(CVE-2024-49769)","status":"published","published":"2025-04-18T11:08:31Z","modified":"2026-08-18T01:18:45.796254009Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"PYSEC-2024-211","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.","status":"published","published":"2024-10-29T15:15:12Z","modified":"2025-01-19T19:56:44.597517Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"RHSA-2024:10145","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.39 packages and security update","status":"published","published":"2024-11-26T13:00:08Z","modified":"2026-07-03T10:04:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:10535","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.70 security update","status":"published","published":"2024-12-05T10:02:28Z","modified":"2026-07-03T10:04:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:10815","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.54 packages and security update","status":"published","published":"2024-12-12T10:02:15Z","modified":"2026-07-03T10:04:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:9613","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.5 security update","status":"published","published":"2024-11-25T09:51:35Z","modified":"2026-07-03T10:06:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2024:9618","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.23 packages and security update","status":"published","published":"2024-11-25T09:52:05Z","modified":"2026-07-03T10:06:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2024:9623","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.41 packages and security update","status":"published","published":"2024-11-25T09:52:15Z","modified":"2026-07-03T10:06:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0201","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-waitress) security update","status":"published","published":"2025-01-10T10:02:57Z","modified":"2026-07-03T10:06:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:1191","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-waitress) security update","status":"published","published":"2025-02-10T10:02:55Z","modified":"2026-07-03T10:06:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:1192","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-waitress) security update","status":"published","published":"2025-02-10T10:02:56Z","modified":"2026-07-03T10:06:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"UBUNTU-CVE-2024-49769","description":"Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.","status":"published","published":"2024-10-29T15:15:00Z","modified":"2026-02-04T04:35:53.330296Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"CLSA-2025-1750810248","title":"TuxCare security update for waitress (1 CVE)","description":"TuxCare rebuilt waitress to address 1 CVE. Fixed in 2.1.2.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:46:27.829068624Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"DLA-3955-1","title":"waitress - security update","status":"published","published":"2024-11-16T00:00:00Z","modified":"2026-03-09T01:18:16.587617Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2025-0053","title":"Updated python-waitress packages fix security vulnerabilities","description":"Waitress has a request processing race condition in HTTP pipelining with\nan invalid first request. (CVE-2024-49768)\nWaitress has a denial of service leading to high CPU usage/resource\nexhaustion. (CVE-2024-49769)\n","status":"published","published":"2025-02-12T06:37:33Z","modified":"2026-04-16T04:43:57.643400698Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14445-1","title":"python310-waitress-3.0.1-1.1 on GA media","description":"These are all security issues fixed in the python310-waitress-3.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-31T00:00:00Z","modified":"2026-02-04T02:58:53.626147Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2026:12047-1","title":"python313-waitress-3.0.2-1.7 on GA media","description":"These are all security issues fixed in the python313-waitress-3.0.2-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:39.005214772Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2024:3876-1","title":"Security update for python-waitress","description":"This update for python-waitress fixes the following issues:\n\n- CVE-2024-49768: Fixed request processing race condition in HTTP pipelining with invalid first request when lookahead is enabled (bsc#1232556)\n- CVE-2024-49769: Fixed incorrect connection clean up leads to a busy-loop and resource exhaustion (bsc#1232554)\n","status":"published","published":"2024-11-01T15:29:32Z","modified":"2026-02-04T04:16:49.563209Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4107-1","title":"Security update for python-waitress","description":"This update for python-waitress fixes the following issues:\n\n- CVE-2024-49769: Fixed a denial of service caused by incorrect connection clean up (bsc#1232554)\n","status":"published","published":"2024-11-28T15:12:34Z","modified":"2026-02-04T02:45:27.859954Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-7115-1","title":"Waitress vulnerabilities","description":"It was discovered that Waitress could process follow up requests when\nreceiving a specially crafted message. An attacker could use this issue to\nhave the server process inconsistent client requests. This issue only\naffected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-49768)\n\nDylan Jay discovered that Waitress could be lead to write to an unexisting\nsocket after closing the remote connection. An attacker could use this\nissue to increase resource utilization leading to a denial of service.\n(CVE-2024-49769)\n","status":"published","published":"2024-11-19T17:19:55Z","modified":"2026-04-27T17:34:39.561883Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}