Homepage

HTTP Request Smuggling The advisory has been revoked - it doesn't affect any version of package python-waitress.src  (opens in a new tab)

Threat Intelligence

EPSS
1.02% (78th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PYTHONWAITRESSSRC-12615385
  • published11 Sept 2025
  • disclosed20 Dec 2019
Report a new vulnerability Found a mistake?

Introduced: 20 Dec 2019

CVE-2019-16785  (opens in a new tab)
CWE-444  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-waitress.src package and not the python-waitress.src package as distributed by RHEL.

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.

References