Skip to content
OpenAdvisories
Critical RHSA-2025:0201 2 CVEs

Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-waitress) security update

Published Jan 10, 2025 · Updated Jul 3, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · OpenStack 16 openstack:16.2::el8 python-waitress 0:2.0.0-4.el8ost
Red Hat · OpenStack 16 openstack:16.2::el8 python3-waitress 0:2.0.0-4.el8ost

Vulnerabilities 2

  • Critical 9.1
    CVE-2024-49768

    Waitress has request processing race condition in HTTP pipelining with invalid first request

    Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we…

    Pylons Waitress waitress waitress Debian Ubuntu Azure Linux PyPI
  • High 7.5
    CVE-2024-49769

    Waitress has a denial of service leading to high CPU usage/resource exhaustion

    Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempti…

    Pylons Waitress waitress waitress Debian Ubuntu Azure Linux PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2322460
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2322461
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0201.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-49768
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-49768
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-49768
  • article
    https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65
  • article
    https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj
  • report
    https://access.redhat.com/security/cve/CVE-2024-49769
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-49769
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-49769
  • article
    https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95c
  • article
    https://github.com/Pylons/waitress/issues/418
  • article
    https://github.com/Pylons/waitress/pull/435
  • article
    https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6