View all vulnerabilities

CVE-2024-49769

Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion

### ImpactWhen a remote client closes the connection before waitress has had the opportunity to call `getpeername()` waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function.A remote attacker could run waitress out of available sockets with very little resources required.### PatchesWaitress 3.0.1 contains fixes that remove the race condition.### WorkaroundsNo work-around.### References- https://github.com/Pylons/waitress/issues/418- https://github.com/Pylons/waitress/pull/435

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
7.5
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
waitress < 3.0.1
Severity
High
Ecosystem
Python
Publish Date
October 29, 2024
Modified Date
January 21, 2025