Vulnerabilities for waitress

First version without a known vulnerability: 3.0.1

Details

• GHSA-9298-4cf8-g4wj2024-10-29

  Waitress has request processing race condition in HTTP pipelining with invalid first request

  Fixed in: 3.0.1, e4359018537af376cf24bd13616d861e2fb76f65

• GHSA-3f84-rpwh-47g62024-10-29

  Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion

  Fixed in: 3.0.1, 1ae4e894c9f76543bee06584001583fc6fa8c95c

• GHSA-f5x9-8jwc-25rw2022-06-02

  Uncaught Exception (due to a data race) leads to process termination in Waitress

  Fixed in: 2.1.2, 4f6789b035610e0552738cdc4b35ca809a592d48

• GHSA-4f7p-27jc-3c362022-03-18

  HTTP Request Smuggling in waitress

  Fixed in: 2.1.1, 9e0b8c801e4d505c2ffc91b891af4ba48af715e0

• GHSA-73m2-3pwg-5fgc2020-02-04

  Catastrophic backtracking in regex allows Denial of Service in Waitress

  Fixed in: 1.4.3, 6e46f9e3f014d64dd7d1e258eaf626e39870ee1f

• GHSA-968f-66r5-5v742020-01-06

  HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)

  Fixed in: 1.4.2, 11d9e138125ad46e951027184b13242a3c1de017, 1.4.1

• GHSA-m5ff-3wj3-8ph42019-12-26

  HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress

  Fixed in: 1.4.1

• GHSA-4ppp-gpcr-7qf62019-12-20

  HTTP Request Smuggling: Content-Length Sent Twice in Waitress

  Fixed in: 1.4.0, 575994cd42e83fd772a5f7ec98b2c56751bd3f65

• GHSA-g2xc-35jw-c63p2019-12-20

  HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

  Fixed in: 1.4.0, f11093a6b3240fc26830b6111e826128af7771c3, 1.3.1

• GHSA-pg36-wpm5-g57p2019-12-20

  HTTP Request Smuggling: LF vs CRLF handling in Waitress

  Fixed in: 1.4.0, 8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba