Pylons vulnerabilities

Products

• Waitress 9
• Webob 3

Newest

• pylons webob WebOb: Open redirect in Location header normalization via leading C0 control / space characters CVE-2026-54770 Fix available 6.1 MediumAugust 20, 2026
• pylons webob WebOb: Location header normalization during redirect leads to open redirect CVE-2026-44889 Fix available 6.1 MediumJune 4, 2026
• agendaless waitress Waitress has request processing race condition in HTTP pipelining with invalid first request CVE-2024-49768 Fix available 9.1 CriticalOctober 29, 2024
• agendaless waitress Waitress has a denial of service leading to high CPU usage/resource exhaustion CVE-2024-49769 Fix available 7.5 HighOctober 29, 2024
• pylons webob WebOb's location header normalization during redirect leads to open redirect CVE-2024-42353 Fix available 6.1 MediumAugust 14, 2024
• agendaless pyramid, fedoraproject fedora +1 more Pyramid static view path traversal up one directory CVE-2023-40587 Fix available 4.3 MediumAugust 25, 2023
• pylons horus Pylons horus services.py timing discrepancy CVE-2014-125056 2.6 LowJanuary 7, 2023
• agendaless waitress Uncaught Exception (due to a data race) leads to process termination in Waitress CVE-2022-31015 Fix available 6.5 MediumMay 31, 2022
• agendaless waitress, debian linux +1 more HTTP Request Smuggling in waitress CVE-2022-24761 Fix available 7.5 HighMarch 17, 2022
• agendaless waitress Catastrophic backtracking in regex allows Denial of Service in Waitress CVE-2020-5236 Public exploitFix available 5.7 MediumFebruary 4, 2020
• agendaless waitress, debian linux, fedoraproject fedora +2 more +4 more HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers CVE-2019-16789 Fix available 7.1 HighDecember 26, 2019
• agendaless waitress, debian linux, oracle communications cloud native core network function cloud native environment +2 more HTTP Request Smuggling: Content-Length Sent Twice in Waitress CVE-2019-16792 Fix available 7.1 HighDecember 20, 2019
• agendaless waitress, debian linux, fedoraproject fedora +2 more +4 more HTTP Request Smuggling: LF vs CRLF handling in Waitress CVE-2019-16785 Fix available 7.1 HighDecember 20, 2019
• agendaless waitress, debian linux, fedoraproject fedora +2 more +4 more HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress CVE-2019-16786 Fix available 7.1 HighDecember 20, 2019