HTTP Request Smuggling in waitress
Published Mar 17, 2022 · Updated Oct 23, 2026 · Also known as GHSA-4f7p-27jc-3c36, PYSEC-2022-169
Original summary
Normalized public record · Updated Oct 23, 2026
HTTP Request Smuggling in waitress
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
When using Waitress behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends.
Potential impact
When using Waitress behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends. This would allow requests to be smuggled via the front-end proxy to waitress and later behavior. There are two classes of vulnerability that may lead to request smuggling that are addressed by this advisory: - The use of Python's int() to parse strings into integers, leading to +10 to be parsed as 10, or 0x01 to be parsed as 1, where as the standard specifies that the string should contain only digits or hex digits. - Waitress does not support chunk extensions, however it was discarding them without validating that they did not contain illegal characters
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- MEDIUM
- Confidence
- 10%
- Aliases
- GHSA-4f7p-27jc-3c36, PYSEC-2022-169
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- Security advisory ↗
- Patch commit ↗
- Source repository ↗
- [debian-lts-announce] 20220512 [SECURITY] [DLA 3000-1] waitress security update ↗
- DSA-5138 ↗
Record history
Published Mar 17, 2022 · Last refreshed Oct 23, 2026