CVE-2019-16792: HTTP Request Smuggling: Content-Length Sent Twice in Waitress

Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally.

So a request with:

Content-Length: 10
Content-Length: 10

would get transformed to:

Content-Length: 10, 10

Which would Waitress would then internally set to Content-Lenght: 0.

Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.