CVE-2019-16786

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.

• CWE-444
• CWE-444

• https://access.redhat.com/errata/RHSA-2020:0720Third Party Advisory
• https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixesRelease Notes, Vendor Advisory
• https://github.com/Pylons/waitress/commit/f11093a6b3240fc26830b6111e826128af7771c3Patch, Third Party Advisory
• https://github.com/Pylons/waitress/security/advisories/GHSA-g2xc-35jw-c63pThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/05/msg00011.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5/
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2020:0720Third Party Advisory
• https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixesRelease Notes, Vendor Advisory
• https://github.com/Pylons/waitress/commit/f11093a6b3240fc26830b6111e826128af7771c3Patch, Third Party Advisory
• https://github.com/Pylons/waitress/security/advisories/GHSA-g2xc-35jw-c63pThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/05/msg00011.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5/
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Published

Dec 20, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1678A vulnerability in Cisco Meeting Server could allow an authe…4.3
• CVE-2019-16780WordPress users with lower privileges (like contributors) ca…5.4
• CVE-2019-16781In WordPress before 5.3.1, authenticated users with lower pr…5.4
• CVE-2019-16782There's a possible information leak / session hijack vulnera…5.9
• CVE-2019-16784In PyInstaller before version 3.6, only on Windows, a local …7.8
• CVE-2019-16785Waitress through version 1.3.1 implemented a "MAY" part of t…7.5
• CVE-2019-16787Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-16788Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-16789In Waitress through version 1.4.0, if a proxy server is used…8.2
• CVE-2019-1679A vulnerability in the web interface of Cisco TelePresence C…5
• CVE-2019-16790In Tiny File Manager before 2.3.9, there is a remote code ex…8.8
• CVE-2019-16791In postfix-mta-sts-resolver before 0.5.1, All users can rece…5.9