CVE-2024-49768

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.

• CWE-367
• CWE-444

• https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65Patch
• https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wjVendor Advisory

Published

Oct 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-49762Pterodactyl is a free, open-source game server management pa…4.6
• CVE-2024-49763PlexRipper is a cross-platform media downloader for Plex. Pl…8.7
• CVE-2024-49764LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-49765Discourse is an open source platform for community discussio…9.1
• CVE-2024-49766Werkzeug is a Web Server Gateway Interface web application l…5.3
• CVE-2024-49767Werkzeug is a Web Server Gateway Interface web application l…7.5
• CVE-2024-49769Waitress is a Web Server Gateway Interface server for Python…7.5
• CVE-2024-4977The Index WP MySQL For Speed WordPress plugin before 1.4.18 …6.8
• CVE-2024-49770`oak` is a middleware framework for Deno's native HTTP serve…7.7
• CVE-2024-49771MPXJ is an open source library to read and write project pla…5.3
• CVE-2024-49772SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2024-49773SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5