CVE-2019-16792: HTTP Request Smuggling Content-Length Sent Twice Vulnerability
CRITICALCVE-2019-16792 is a CRITICAL content-length sent twice vulnerability (CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')) affecting HTTP Request Smuggling libraries in the PyPI ecosystem. The issue involves content-length sent twice in waitress. Remediation is available by upgrading affected packages to version 1.4.0.
CVE-2019-16792 at a Glance
How to Fix CVE-2019-16792
To remediate this vulnerability, upgrade all affected HTTP Request Smuggling dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install waitress>=1.4.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show waitressHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2019-16792, inspect your installed packages using pip:
pip show waitressAnalyze the terminal output to locate any version of HTTP Request Smuggling in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.4.0), your application is affected.
Note: The pip show waitress command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), where the product acts as an intermediary http agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed http requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. In HTTP Request Smuggling, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2019-16792 Affected HTTP Request Smuggling Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
waitress
|
PyPI |
< 1.4.0
|
1.4.0
|
References
Frequently Asked Questions
What is CVE-2019-16792?
Which HTTP Request Smuggling versions are affected?
What version fixes CVE-2019-16792?
Is waitress affected?
What CWE is associated with CVE-2019-16792?
How can I check PyPI dependencies for CVE-2019-16792?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-4ppp-gpcr-7qf6",
"modified" : "2026-01-22T22:34:11Z",
"published" : "2019-12-20T23:04:35Z",
"aliases" : [ "CVE-2019-16792" ],
"summary" : "HTTP Request Smuggling: Content-Length Sent Twice in Waitress",
"details" : "### Impact\n\nWaitress would header fold a double `Content-Length` header and due to being unable to cast the now comma separated value to an integer would set the `Content-Length` to 0 internally.\n\nSo a request with:\n\n```\nContent-Length: 10\nContent-Length: 10\n```\n\nwould get transformed to:\n\n```\nContent-Length: 10, 10\n```\n\nWhich would Waitress would then internally set to `Content-Lenght: 0`.\n\nWaitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.\n\n### Patches\n\nThis issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. \n\nThe Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don't cause any changes in behavior.\n\n### Workarounds\n\nVarious reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn't use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).\n\n### Issues/more security issues:\n\n* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)\n* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "waitress"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.4.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/Pylons/waitress/security/advisories/GHSA-4ppp-gpcr-7qf6"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2019-16792"
}, {
"type" : "WEB",
"url" : "https://github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65"
}, {
"type" : "WEB",
"url" : "https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/Pylons/waitress"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2020-178.yaml"
}, {
"type" : "WEB",
"url" : "https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html"
}, {
"type" : "WEB",
"url" : "https://www.oracle.com/security-alerts/cpuapr2022.html"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-444" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2019-12-20T23:02:03Z",
"nvd_published_at" : null
}
}