p PatchFirst

CVE-2020-5236

CVE-2020-5236 · Catastrophic backtracking in regex allows Denial of Service in Waitress

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.

CVSS 5.7 · Medium · EPSS 2.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • waitress

    Versions
    • = 1.4.2: Affected

    No fix published

  • waitress PyPI

    Versions
    • 1.4.2
    Affected ranges
    • ECOSYSTEM: ≥ 1.4.2, < 1.4.3

    Update to 1.4.3

  • waitress PyPI

    Versions
    • 0.1
    • 0.2
    • 0.3
    • 0.4
    • 0.5
    • 0.6
    • 0.6.1
    • 0.7
    • 0.8
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 0.8.4
    • 0.8.5
    • 0.8.6
    • 0.8.7
    • 0.8.8
    • 0.8.9
    • 0.8.10
    • 0.8.11b0
    • 0.9.0b0
    • 0.9.0b1
    • 0.9.0
    • 1.0a1
    • 1.0a2
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.1.0
    • 1.2.0b1
    • 1.2.0b2
    • 1.2.0b3
    • 1.2.0
    • 1.2.1
    • 1.3.0b0
    • 1.3.0
    • 1.3.1
    • 1.4.0
    • 1.4.1
    • 1.4.2
    Affected ranges
    • GIT: < 6e46f9e3f014d64dd7d1e258eaf626e39870ee1f
    • ECOSYSTEM: < 1.4.3

    Update to 1.4.3

Original sources

Check your server →