CVE-2024-49768 Waitress has request processing race condition in HTTP pipelining with invalid first request
A race condition in Waitress allows secondary requests to be processed after a connection should have closed, bypassing security controls when request lookahead is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49768?
CVE-2024-49768 is a critical vulnerability in Pylons waitress, published on 29 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.
Which versions are affected by CVE-2024-49768?
3 open source packages ship an affected version, including waitress. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
waitress PyPI | From 2.0.0 | 3.0.1 |
waitress PyPI | From 2.0.0 | 3.0.1 |
waitress PyPI | From 2.0.0 | 3.0.1 |
Products include Agendaless Waitress.
How do I fix CVE-2024-49768?
Upgrade waitress to 3.0.1 or later.
Is CVE-2024-49768 being exploited?
There is no known exploitation of CVE-2024-49768 in the wild and no public exploit code.
Other vulnerabilities in Pylons waitress
- CVE-2024-49769 Waitress has a denial of service leading to high CPU usage/resource exhaustion
- CVE-2022-24761 HTTP Request Smuggling in waitress
- CVE-2019-16792 HTTP Request Smuggling: Content-Length Sent Twice in Waitress
- CVE-2019-16789 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers
- CVE-2019-16785 HTTP Request Smuggling: LF vs CRLF handling in Waitress
Sources
Also known as AZL-57396, CLSA-2025-1750810247, DEBIAN-CVE-2024-49768, ECHO-b844-fa43-fd25, GHSA-9298-4cf8-g4wj, OESA-2024-2333 and 5 more.