CVE-2019-16792CWE-444

HTTP Request Smuggling: Content-Length Sent Twice in Waitress

High · published January 22, 2020

CVSS v3.1
7.1
EPSS
2%
Percentile
80.4
In the wild
Unconfirmed
What it is

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01984 · 80.4th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2020-01-22T18:30Z
EPSS history
Timeline
  • 22 JAN 18:30Z
    HTTP Request Smuggling: Content-Length Sent Twice in Waitress
    cvelistv5