CVE-2020-5236
published 2020-02-04CVE-2020-5236: Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header…
PriorityP333medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
2.64%
84.0th percentile
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| agendaless | waitress | — | — |
| debian | waitress | — | — |
| pylons | waitress | — | — |
| pylons | waitress | >= 0 < 6e46f9e3f014d64dd7d1e258eaf626e39870ee1f | 6e46f9e3f014d64dd7d1e258eaf626e39870ee1f |
| pylons | waitress | >= 0 < 1.4.3 | 1.4.3 |
| pylons | waitress | >= 1.4.2 < 1.4.3 | 1.4.3 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.06.8MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:C
vendor_debian5.7LOW
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
waitress: header with invalid characters can lead to DoS
vendor_redhat·2020-02-03·CVSS 5.7
CVE-2020-5236 [MEDIUM] CWE-400 waitress: header with invalid characters can lead to DoS
waitress: header with invalid characters can lead to DoS
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new ver
Debian
CVE-2020-5236: waitress - Waitress version 1.4.2 allows a DOS attack When waitress receives a header that ...
vendor_debian·2020·CVSS 5.7
CVE-2020-5236 [MEDIUM] CVE-2020-5236: waitress - Waitress version 1.4.2 allows a DOS attack When waitress receives a header that ...
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.
Scope: local
bookwor
OSV
Catastrophic backtracking in regex allows Denial of Service in Waitress
osv·2020-02-04
CVE-2020-5236 [MEDIUM] Catastrophic backtracking in regex allows Denial of Service in Waitress
Catastrophic backtracking in regex allows Denial of Service in Waitress
### Impact
When waitress receives a header that contains invalid characters it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions.
This would allow an attacker to send a single request with an invalid header and take the service offline.
Invalid header example:
```
Bad-header: xxxxxxxxxxxxxxx\x10
```
Increasing the number of `x`'s in the header will increase the amount of time Waitress spends in the regular expression engine.
This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230.
### Patches
The regular express
GHSA
Catastrophic backtracking in regex allows Denial of Service in Waitress
ghsa·2020-02-04
CVE-2020-5236 [MEDIUM] CWE-400 Catastrophic backtracking in regex allows Denial of Service in Waitress
Catastrophic backtracking in regex allows Denial of Service in Waitress
### Impact
When waitress receives a header that contains invalid characters it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions.
This would allow an attacker to send a single request with an invalid header and take the service offline.
Invalid header example:
```
Bad-header: xxxxxxxxxxxxxxx\x10
```
Increasing the number of `x`'s in the header will increase the amount of time Waitress spends in the regular expression engine.
This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230.
### Patches
The regular express
OSV
CVE-2020-5236: Waitress version 1
osv·2020-02-04
CVE-2020-5236 CVE-2020-5236: Waitress version 1
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.
No detection rules found.
No public exploits indexed.
https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1fhttps://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgchttps://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1fhttps://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgc
2020-02-04
Published