Skip to content
Fencer Vulns
high 7.5

CVE-2022-24761 json

HTTP Request Smuggling in waitress

published 2022-03-17 4 y ago modified 2026-06-17 4 mo ago also GHSA-4f7p-27jc-3c36 , PYSEC-2022-169 , EUVD-2022-0358

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends. This would allow requests to be smuggled via the front-end proxy to waitress and later behavior. There are two classes of vulnerability that may lead to request smuggling that are addressed by this advisory: The use of Python's `int()` to parse strings into integers, leading to `+10` to be parsed as `10`, or `0x01` to be parsed as `1`, where as the standard specifies that the string should contain only digits or hex digits; and Waitress does not support chunk extensions, however it was discarding them without validating that they did not contain illegal characters. This vulnerability has been patched in Waitress 2.1.1. A workaround is available. When deploying a proxy in front of waitress, turning on any and all functionality to make sure that the request matches the RFC7230 standard. Certain proxy servers may not have this functionality though and users are encouraged to upgrade to the latest version of waitress instead.

Patch / fix

  • pypi waitress 2.1.1
  • agendaless waitress 2.1.1
  • waitress Debian 14, Debian 13, Debian 12 2.1.1-1

debian advisories DEBIAN-CVE-2022-24761

  • waitress Ubuntu 20.04 LTS 1.4.1-1ubuntu0.1
  • waitress Ubuntu 22.04 LTS 1.4.4-1.1ubuntu1

ubuntu advisories UBUNTU-CVE-2022-24761

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-waitress openstack 13 1.4.4-2.el7ost
  • python2-waitress openstack 13 1.4.4-2.el7ost
  • python-waitress openstack 16.2, openstack 16.1 2.0.0-1.el8ost
  • python3-waitress openstack 16.2, openstack 16.1 2.0.0-1.el8ost

red hat advisories RHSA-2022:1264RHSA-2022:1254RHSA-2022:1253

  • python-waitress SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +22 more 1.4.3-150000.3.6.1
  • python-waitress OpenStack Cloud Crowbar 9, OpenStack Cloud Crowbar 8, OpenStack Cloud 9 +2 more 1.4.3-3.6.1

suse advisories SUSE-SU-2022:3731-1SUSE-SU-2022:3635-1SUSE-SU-2022:3583-1

  • python-waitress openSUSE Tumbleweed 3.0.2-1.4

opensuse advisories openSUSE-SU-2025:15108-1

  • python-waitress Azure Linux 3.0 3.0.1-1

azure linux advisories AZL-45060

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • python-waitress Arch Linux 2.1.1-1

arch linux advisories AVG-2723

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-24761 updated cvss 7.5

waitress: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

  • Red Hat Ceph Storage 3 python-waitress
    affected: no fix planned “Out of support scope”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: no fix available
  • Red Hat OpenStack Platform 13.0 - ELS python-waitress 1.4.4-2.el7ost, python2-waitress 1.4.4-2.el7ost
    fixed: vendor fix RHSA-2022:1264
  • Red Hat OpenStack Platform 16.1 python-waitress 2.0.0-1.el8ost, python3-waitress 2.0.0-1.el8ost
    fixed: vendor fix RHSA-2022:1254
  • Red Hat OpenStack Platform 16.2 python-waitress 2.0.0-1.el8ost, python3-waitress 2.0.0-1.el8ost
    fixed: vendor fix RHSA-2022:1253
  • Red Hat Ceph Storage 4 python-waitress, python3-waitress Red Hat Ceph Storage 5 python-waitress Red Hat Openshift Data Foundation 4 python-waitress
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.78% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi waitress
<2.1.1
2.1.1

Affected products

  • Pylons waitress

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.