Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. waitress
  4. ›
  5. CVE-2024-49769

CVE-2024-49769: Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion

October 29, 2024 (updated January 21, 2025)

When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won’t correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function.

A remote attacker could run waitress out of available sockets with very little resources required.

References

  • github.com/Pylons/waitress
  • github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95c
  • github.com/Pylons/waitress/issues/418
  • github.com/Pylons/waitress/pull/435
  • github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6
  • github.com/advisories/GHSA-3f84-rpwh-47g6
  • github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2024-211.yaml
  • lists.debian.org/debian-lts-announce/2024/11/msg00012.html
  • nvd.nist.gov/vuln/detail/CVE-2024-49769

Code Behaviors & Features

Detect and mitigate CVE-2024-49769 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 3.0.1

Fixed versions

  • 3.0.1

Solution

Upgrade to version 3.0.1 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-772: Missing Release of Resource after Effective Lifetime

Source file

pypi/waitress/CVE-2024-49769.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:22 +0000.