CVE-2019-16789

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.

• CWE-444
• CWE-444

• https://access.redhat.com/errata/RHSA-2020:0720Third Party Advisory
• https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixesRelease Notes, Vendor Advisory
• https://github.com/Pylons/waitress/commit/11d9e138125ad46e951027184b13242a3c1de017Patch, Third Party Advisory
• https://github.com/github/advisory-review/pull/14604Broken Link, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/05/msg00011.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5/
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2020:0720Third Party Advisory
• https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixesRelease Notes, Vendor Advisory
• https://github.com/Pylons/waitress/commit/11d9e138125ad46e951027184b13242a3c1de017Patch, Third Party Advisory
• https://github.com/github/advisory-review/pull/14604Broken Link, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/05/msg00011.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5/
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Published

Dec 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16782There's a possible information leak / session hijack vulnera…5.9
• CVE-2019-16784In PyInstaller before version 3.6, only on Windows, a local …7.8
• CVE-2019-16785Waitress through version 1.3.1 implemented a "MAY" part of t…7.5
• CVE-2019-16786Waitress through version 1.3.1 would parse the Transfer-Enco…7.5
• CVE-2019-16787Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-16788Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-1679A vulnerability in the web interface of Cisco TelePresence C…5
• CVE-2019-16790In Tiny File Manager before 2.3.9, there is a remote code ex…8.8
• CVE-2019-16791In postfix-mta-sts-resolver before 0.5.1, All users can rece…5.9
• CVE-2019-16792Waitress through version 1.3.1 allows request smuggling by s…7.5
• CVE-2019-16793Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-16794Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…