Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-31015 EUVD-2022-0359GHSA-f5x9-8jwc-25rwPYSEC-2022-205

Uncaught Exception (due to a data race) leads to process termination in Waitress

Published May 31, 2022 · Updated Apr 22, 2025 · Assigned by GitHub_M

Description

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

Affected products

VendorProductAffectedFixed
Pylons waitress >= 2.1.0, < 2.1.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 waitress 2.1.2-1 —
Debian 13 waitress 2.1.2-1 —
Debian 12 waitress 2.1.2-1 —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-waitress 3.0.2-1.4 openSUSE-SU-2025:15108-1
ReleasePackageFixed inAdvisory
Alpine v3.24 py3-waitress 2.1.2-r0 —
Alpine v3.23 py3-waitress 2.1.2-r0 —
Alpine v3.22 py3-waitress 2.1.2-r0 —
Alpine v3.21 py3-waitress 2.1.2-r0 —
Alpine v3.20 py3-waitress 2.1.2-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 py3-waitress 2.1.2-r0 —
Alpine v3.18 py3-waitress 2.1.2-r0 —
Alpine v3.17 py3-waitress 2.1.2-r0 —
Alpine v3.16 py3-waitress 2.1.2-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-waitress 3.0.1-1 —
Azure Linux 2 (CBL-Mariner) python-waitress No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI waitress >= 2.1.0, < 2.1.2 2.1.2 GHSA-f5x9-8jwc-25rw

Advisories 1

References