CVE-2024-49768 — Time-of-check Time-of-use (TOCTOU) Race Condition in Waitress
Severity
4.8MEDIUMNVD
CNA9.1
EPSS
0.6%
top 31.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 29
Latest updateNov 19
Description
Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the err…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 2.2 | Impact: 2.5
Affected Packages2 packages
Patches
🔴Vulnerability Details
5CVEList▶
Waitress has request processing race condition in HTTP pipelining with invalid first request↗2024-10-29
GHSA▶
Waitress has request processing race condition in HTTP pipelining with invalid first request↗2024-10-29
OSV▶
Waitress has request processing race condition in HTTP pipelining with invalid first request↗2024-10-29