CVE-2020-5236

Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.

• CWE-400
• CWE-400

• https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1fPatch, Third Party Advisory
• https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgcThird Party Advisory
• https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1fPatch, Third Party Advisory
• https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgcThird Party Advisory

Published

Feb 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5230Opencast before 8.1 and 7.6 allows almost arbitrary identifi…7.5
• CVE-2020-5231In Opencast before 7.6 and 8.1, users with the role ROLE_COU…6.5
• CVE-2020-5232A user who owns an ENS domain can set a trapdoor, allowing t…8.7
• CVE-2020-5233OAuth2 Proxy before 5.0 has an open redirect vulnerability. …6.1
• CVE-2020-5234MessagePack for C# and Unity before version 1.9.11 and 2.1.9…6.5
• CVE-2020-5235There is a potentially exploitable out of memory condition I…9.8
• CVE-2020-5237Multiple relative path traversal vulnerabilities in the oneu…8.8
• CVE-2020-5238The table extension in GitHub Flavored Markdown before versi…6.5
• CVE-2020-5239In Mailu before version 1.7, an authenticated user can explo…8.8
• CVE-2020-5240In wagtail-2fa before 1.4.1, any user with access to the CMS…8.5
• CVE-2020-5241matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XS…5.4
• CVE-2020-5242openHAB before 2.5.2 allow a remote attacker to use REST cal…8.8