Skip to content
Fencer Vulns
critical 9.1

CVE-2024-49768 json

Waitress has request processing race condition in HTTP pipelining with invalid first request

published 2024-10-29 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-0187 , GHSA-9298-4cf8-g4wj , PYSEC-2024-210

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.

Patch / fix

  • pypi waitress 3.0.1
  • Pylons waitress 3.0.1
  • waitress Debian 12 2.1.2-2+deb12u1
  • waitress Debian 14, Debian 13 3.0.1-1

debian advisories DEBIAN-CVE-2024-49768

  • waitress Ubuntu Pro 24.04 LTS 2.1.2-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2024-49768

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-waitress openstack 17.1, openstack 16.2 2.0.0-4.el8ost
  • python3-waitress openstack 17.1, openstack 16.2 2.0.0-4.el8ost
  • python-waitress openstack 17.1 2.0.0-4.el9ost
  • python3-waitress openstack 17.1 2.0.0-4.el9ost
  • python-waitress openshift ironic 4.17, openshift ironic 4.16, openshift ironic 4.15 +3 more 3.0.1-1.el9
  • python3-waitress openshift ironic 4.17, openshift ironic 4.16, openshift ironic 4.15 +3 more 3.0.1-1.el9

red hat advisories RHSA-2025:1192RHSA-2025:1191RHSA-2025:0201RHSA-2024:10815RHSA-2024:10535RHSA-2024:10145

  • python-waitress SLES 15 SP4-LTSS, SLE Module for Python 3 15 SP6, SLE Module for Python 3 15 SP5 +3 more 2.1.2-150400.12.7.1

suse advisories SUSE-SU-2024:3876-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-49768 updated cvss 4.8

waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request

  • Red Hat Ceph Storage 4 python-waitress, python3-waitress
    affected: workaround, no fix planned “Disable `channel_request_lookahead`. This feature is disabled (set to 0) by default.”
  • Red Hat Ceph Storage 5 python-waitress Red Hat Openshift Container Storage 4 python-waitress
    affected: workaround, no fix available “Disable `channel_request_lookahead`. This feature is disabled (set to 0) by default.”
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.12 python-waitress 3.0.1-1.el9, python3-waitress 3.0.1-1.el9
    fixed: vendor fix “Disable `channel_request_lookahead`. This feature is disabled (set to 0) by default.” RHSA-2024:10535
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 python-waitress 3.0.1-1.el9, python3-waitress 3.0.1-1.el9
    fixed: vendor fix “Disable `channel_request_lookahead`. This feature is disabled (set to 0) by default.” RHSA-2024:10815
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.14 python-waitress 3.0.1-1.el9, python3-waitress 3.0.1-1.el9
    fixed: vendor fix “Disable `channel_request_lookahead`. This feature is disabled (set to 0) by default.” RHSA-2024:9623
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.15 python-waitress 3.0.1-1.el9, python3-waitress 3.0.1-1.el9
    fixed: vendor fix “Disable `channel_request_lookahead`. This feature is disabled (set to 0) by default.” RHSA-2024:10145
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.16 python-waitress 3.0.1-1.el9, python3-waitress 3.0.1-1.el9
    fixed: vendor fix “Disable `channel_request_lookahead`. This feature is disabled (set to 0) by default.” RHSA-2024:9618
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.17 python-waitress 3.0.1-1.el9, python3-waitress 3.0.1-1.el9
    fixed: vendor fix “Disable `channel_request_lookahead`. This feature is disabled (set to 0) by default.” RHSA-2024:9613
show 3 more
  • Red Hat OpenStack Platform 16.2 python-waitress 2.0.0-4.el8ost, python3-waitress 2.0.0-4.el8ost
    fixed: vendor fix “Disable `channel_request_lookahead`. This feature is disabled (set to 0) by default.” RHSA-2025:0201
  • Red Hat OpenStack Platform 17.1 python-waitress 2.0.0-4.el8ost, python-waitress 2.0.0-4.el9ost, python3-waitress 2.0.0-4.el8ost, python3-waitress 2.0.0-4.el9ost
    fixed: vendor fix “Disable `channel_request_lookahead`. This feature is disabled (set to 0) by default.” RHSA-2025:1192
  • Red Hat OpenShift Container Platform 4.12 kernel-rt 4.18.0-372.131.1.rt7.291.el8_6, kernel-rt-kvm 4.18.0-372.131.1.rt7.291.el8_6, kernel-rt-core 4.18.0-372.131.1.rt7.291.el8_6, kernel-rt-modules 4.18.0-372.131.1.rt7.291.el8_6, kernel-rt-debug-kvm 4.18.0-372.131.1.rt7.291.el8_6, kernel-rt-debug-core 4.18.0-372.131.1.rt7.291.el8_6, +11 more Red Hat OpenShift Container Platform 4.13 openshift 4.13.0-202411110736.p0.g53fd427.assembly.stream.el8, openshift 4.13.0-202411110736.p0.g53fd427.assembly.stream.el9, openshift-hyperkube 4.13.0-202411110736.p0.g53fd427.assembly.stream.el8, openshift-hyperkube 4.13.0-202411110736.p0.g53fd427.assembly.stream.el9 Red Hat OpenShift Container Platform 4.14 openshift 4.14.0-202411110739.p0.g03a907c.assembly.stream.el8, openshift 4.14.0-202411110739.p0.g03a907c.assembly.stream.el9, openshift-hyperkube 4.14.0-202411110739.p0.g03a907c.assembly.stream.el8, openshift-hyperkube 4.14.0-202411110739.p0.g03a907c.assembly.stream.el9 Red Hat OpenShift Container Platform 4.16 kata-containers 3.7.0-4.rhaos4.16.el9, openshift 4.16.0-202411111337.p0.g7423cac.assembly.stream.el8, openshift 4.16.0-202411111337.p0.g7423cac.assembly.stream.el9, openshift-kubelet 4.16.0-202411111337.p0.g7423cac.assembly.stream.el8, openshift-kubelet 4.16.0-202411111337.p0.g7423cac.assembly.stream.el9, openshift-hyperkube 4.16.0-202411111337.p0.g7423cac.assembly.stream.el8, +7 more Red Hat OpenShift Container Platform 4.17 kata-containers 3.7.0-4.rhaos4.17.el9, openshift 4.17.0-202411070335.p0.g82afd77.assembly.stream.el8, openshift 4.17.0-202411070335.p0.g82afd77.assembly.stream.el9, openshift-ansible 4.17.0-202411120704.p0.g5c737da.assembly.stream.el8, openshift-ansible 4.17.0-202411120704.p0.g5c737da.assembly.stream.el9, openshift-kubelet 4.17.0-202411070335.p0.g82afd77.assembly.stream.el8, +11 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
OSV 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi waitress
>=2.0.0, <3.0.1
3.0.1

Affected products

  • Pylons waitress

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.