CVE-2019-16792 - CVE House
Back to Database
Status published High CVE-2019-16792

HTTP Request Smuggling: Content-Length Sent Twice in Waitress

Vulnerability Description

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-16792

Credits & Attribution

No credits recorded in the NVD database.

References

More from Pylons

View All →
CVE-2024-49769
Waitress has a denial of service leading to high CPU usage/resource exhaustion
High 7.5
CVE-2024-49768
Waitress has request processing race condition in HTTP pipelining with invalid first request
Critical 9.1
CVE-2024-42353
WebOb's location header normalization during redirect leads to open redirect
Medium 6.1
CVE-2023-40587
Pyramid static view path traversal up one directory
Medium 4.3
CVE-2022-31015
Uncaught Exception (due to a data race) leads to process termination in Waitress
Medium 6.5

Affected Vendor

Affected Software

Waitress
Vulnerable Versions:
<= 1.3.1

Timeline

Official Publish: January 22nd, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Weaknesses (CWE)

CWE-444

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1565.002 Stored Data Manipulation
Impact
T1078 Valid Accounts
Defense Evasion