CVE-2024-49769
published 2024-10-29CVE-2024-49769: Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.39%
69.2th percentile
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| agendaless | waitress | < 3.0.1 | 3.0.1 |
| debian | waitress | < waitress 2.1.2-2+deb12u1 (bookworm) | waitress 2.1.2-2+deb12u1 (bookworm) |
| msrc | azl3_python-waitress_3.0.1-1_on_azure_linux_3.0 | — | — |
| pylons | waitress | < 3.0.1 | 3.0.1 |
| pylons | waitress | >= 0 < 1.4.4-1.1+deb11u2 | 1.4.4-1.1+deb11u2 |
| pylons | waitress | >= 0 < 2.1.2-2+deb12u1 | 2.1.2-2+deb12u1 |
| pylons | waitress | >= 0 < 3.0.1-1 | 3.0.1-1 |
| pylons | waitress | >= 0 < 3.0.1-1 | 3.0.1-1 |
| pylons | waitress | >= 0 < 3.0.1 | 3.0.1 |
| pylons | waitress | >= 0 < 1.4.1-1ubuntu0.2 | 1.4.1-1ubuntu0.2 |
| pylons | waitress | >= 0 < 1.4.4-1.1ubuntu1.1 | 1.4.4-1.1ubuntu1.1 |
| pylons | waitress | >= 0 < 2.1.2-2ubuntu0.1~esm1 | 2.1.2-2ubuntu0.1~esm1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_ubuntu9.1CRITICAL
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Waitress vulnerabilities
vendor_ubuntu·2024-11-19·CVSS 9.1
CVE-2024-49768 [CRITICAL] Waitress vulnerabilities
Title: Waitress vulnerabilities
Summary: Several security issues were fixed in Waitress.
It was discovered that Waitress could process follow up requests when
receiving a specially crafted message. An attacker could use this issue to
have the server process inconsistent client requests. This issue only
affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-49768)
Dylan Jay discovered that Waitress could be lead to write to an unexisting
socket after closing the remote connection. An attacker could use this
issue to increase resource utilization leading to a denial of service.
(CVE-2024-49769)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
waitress: Waitress has a denial of service leading to high CPU usage/resource exhaustion
vendor_redhat·2024-10-29·CVSS 7.5
CVE-2024-49769 [HIGH] CWE-772 waitress: Waitress has a denial of service leading to high CPU usage/resource exhaustion
waitress: Waitress has a denial of service leading to high CPU usage/resource exhaustion
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.
A flaw was found in the Waitress WSGI server for Python. When a remote client closes the connection before waitress has
Microsoft
Waitress has a denial of service leading to high CPU usage/resource exhaustion
vendor_msrc·2024-10-08·CVSS 7.5
CVE-2024-49769 [HIGH] CWE-772 Waitress has a denial of service leading to high CPU usage/resource exhaustion
Waitress has a denial of service leading to high CPU usage/resource exhaustion
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Relea
Debian
CVE-2024-49769: waitress - Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a rem...
vendor_debian·2024·CVSS 7.5
CVE-2024-49769 [HIGH] CVE-2024-49769: waitress - Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a rem...
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.
Scope: local
bookworm: resolved (fixed in 2.1.2-2+deb12u1)
bullseye: resolved (fixed in 1.4.4-1.1+deb11u2)
forky: resolved (fixed in 3.0.1-1)
sid: resolved (fixed in 3.0.1-1)
trixie: resolved (fixed in 3.0.1-1)
OSV
Waitress vulnerabilities
osv·2024-11-19·CVSS 4.8
CVE-2024-49768 [MEDIUM] Waitress vulnerabilities
Waitress vulnerabilities
It was discovered that Waitress could process follow up requests when
receiving a specially crafted message. An attacker could use this issue to
have the server process inconsistent client requests. This issue only
affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-49768)
Dylan Jay discovered that Waitress could be lead to write to an unexisting
socket after closing the remote connection. An attacker could use this
issue to increase resource utilization leading to a denial of service.
(CVE-2024-49769)
OSV
Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion
osv·2024-10-29
CVE-2024-49769 [HIGH] Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion
Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion
### Impact
When a remote client closes the connection before waitress has had the opportunity to call `getpeername()` waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function.
A remote attacker could run waitress out of available sockets with very little resources required.
### Patches
Waitress 3.0.1 contains fixes that remove the race condition.
### Workarounds
No work-around.
### References
- https://github.com/Pylons/waitress/issues/418
- https://github.com/Pylons/waitress/pull/435
GHSA
Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion
ghsa·2024-10-29
CVE-2024-49769 [HIGH] CWE-772 Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion
Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion
### Impact
When a remote client closes the connection before waitress has had the opportunity to call `getpeername()` waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function.
A remote attacker could run waitress out of available sockets with very little resources required.
### Patches
Waitress 3.0.1 contains fixes that remove the race condition.
### Workarounds
No work-around.
### References
- https://github.com/Pylons/waitress/issues/418
- https://github.com/Pylons/waitress/pull/435
OSV
CVE-2024-49769: Waitress is a Web Server Gateway Interface server for Python 2 and 3
osv·2024-10-29·CVSS 7.5
CVE-2024-49769 [HIGH] CVE-2024-49769: Waitress is a Web Server Gateway Interface server for Python 2 and 3
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95chttps://github.com/Pylons/waitress/issues/418https://github.com/Pylons/waitress/pull/435https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6https://lists.debian.org/debian-lts-announce/2024/11/msg00012.html
2024-10-29
Published