{"id":"CVE-2019-16785","aliases":["GHSA-pg36-wpm5-g57p","PYSEC-2019-136"],"title":"HTTP Request Smuggling: LF vs CRLF handling in Waitress","summary":"HTTP Request Smuggling: LF vs CRLF handling in Waitress","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","vendor":"waitress","product":"waitress","ecosystem":"pip","affected":["waitress < 1.4.0"],"patched":["waitress 1.4.0"],"published":"2019-12-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:24.779958466Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pg36-wpm5-g57p","references":[{"url":"https://github.com/Pylons/waitress/security/advisories/GHSA-pg36-wpm5-g57p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16785"},{"url":"https://github.com/Pylons/waitress/commit/8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba"},{"url":"https://access.redhat.com/errata/RHSA-2020:0720"},{"url":"https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes"},{"url":"https://github.com/Pylons/waitress"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2019-136.yaml"},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html"}],"tags":["osv","pip"],"epss":0.02537,"epssPercentile":0.84253,"ingestedAt":"2026-09-12T03:13:01.715Z","slug":"CVE-2019-16785","body":"## Overview\n\n### Impact\n\nWaitress implemented a &amp;quot;MAY&amp;quot; part of the RFC7230 (https://tools.ietf.org/html/rfc7230#section-3.5) which states:\n\n      Although the line terminator for the start-line and header fields is\n      the sequence CRLF, a recipient MAY recognize a single LF as a line\n      terminator and ignore any preceding CR.\n\nUnfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message.\n\nExample:\n\n```\nContent-Length: 100[CRLF]\nX-Header: x[LF]Content-Length: 0[CRLF]\n```\n\nWould get treated by Waitress as if it were:\n\n```\nContent-Length: 100\nX-Header: x\nContent-Length: 0\n```\n\nThis could potentially get used by attackers to split the HTTP request and smuggle a second request in the body of the first.\n\n\n### Patches\n\nThis issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. \n\nWaitress no longer implements the MAY part of the specification and instead requires that all lines are terminated correctly with CRLF. If any lines are found with a bare CR or LF a 400 Bad Request is sent back to the requesting entity.\n\nThe Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don&amp;#39;t cause any changes in behavior.\n\n### Workarounds\n\nVarious reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn&amp;#39;t use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method)\n\n### Issues/more security issues:\n\n* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)\n* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)\n\n## Affected packages\n\n- `waitress < 1.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `waitress 1.4.0`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.1,"likelihood":0.5,"exploitation":0,"ransomware":0},"changes":[]}