CVE-2022-31015

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

• CWE-248
• CWE-362

• https://github.com/Pylons/waitress/commit/4f6789b035610e0552738cdc4b35ca809a592d48Patch, Third Party Advisory
• https://github.com/Pylons/waitress/issues/374Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/Pylons/waitress/pull/377Issue Tracking, Patch, Third Party Advisory
• https://github.com/Pylons/waitress/security/advisories/GHSA-f5x9-8jwc-25rwThird Party Advisory
• https://github.com/Pylons/waitress/commit/4f6789b035610e0552738cdc4b35ca809a592d48Patch, Third Party Advisory
• https://github.com/Pylons/waitress/issues/374Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/Pylons/waitress/pull/377Issue Tracking, Patch, Third Party Advisory
• https://github.com/Pylons/waitress/security/advisories/GHSA-f5x9-8jwc-25rwThird Party Advisory

Published

May 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31009wire-ios is an iOS client for the Wire secure messaging appl…6.5
• CVE-2022-3101A flaw was found in tripleo-ansible. Due to an insecure defa…5.5
• CVE-2022-31011TiDB is an open-source NewSQL database that supports Hybrid …7.8
• CVE-2022-31012Git for Windows is a fork of Git that contains Windows-speci…7.3
• CVE-2022-31013Chat Server is the chat server for Vartalap, an open-source …9.8
• CVE-2022-31014Nextcloud server is an open source personal cloud server. Af…3.5
• CVE-2022-31016Argo CD is a declarative continuous deployment for Kubernete…6.5
• CVE-2022-31017Zulip is an open-source team collaboration tool. Versions 2.…2.6
• CVE-2022-31018Play Framework is a web framework for Java and Scala. A deni…7.5
• CVE-2022-31019Vapor is a server-side Swift HTTP web framework. When using …7.5
• CVE-2022-31020Indy Node is the server portion of a distributed ledger purp…8.8
• CVE-2022-31021Ursa is a cryptographic library for use with blockchains. A …5.3