Vulnetix
Try Vulnetix Request Demo
CVE-2019-16792 PUBLISHED

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

EPSS 0.85% · 74.8th percentile

Risk Scores

EPSS Score
0.85%
74.8th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSwaitress0, 0.8.9-2ubuntu1, 0.8.10-1
Ubuntu:18.04:LTSwaitress0, 1.0.1-1

Timeline

References

Open in Interactive Console →