CVE-2022-24761: Waitress HTTP Request Smuggling Flaw

CVE-2022-24761 Overview

CVE-2022-24761 is an HTTP Request Smuggling vulnerability [CWE-444] affecting Waitress, a Web Server Gateway Interface (WSGI) server for Python 2 and 3. The flaw exists in Waitress versions 2.1.0 and prior when deployed behind a proxy that does not strictly validate inbound HTTP requests against RFC 7230. Waitress and the front-end proxy can disagree on where one request ends and the next begins, enabling an attacker to smuggle requests through the proxy. The root issues are permissive parsing of integer fields with Python's int() and silent acceptance of chunk extensions containing illegal characters. The vulnerability is patched in Waitress 2.1.1.

Critical Impact
Attackers can smuggle crafted HTTP requests through a front-end proxy into Waitress, bypassing proxy-layer security controls and poisoning downstream request handling.

Affected Products

Agendaless Waitress versions 2.1.0 and prior
Debian Linux 9.0 (waitress package, fixed via DSA-5138)
Any Python WSGI application deployed with vulnerable Waitress behind a non-strict reverse proxy

Discovery Timeline

2022-03-17 - CVE-2022-24761 published to the National Vulnerability Database
2022-03-17 - Waitress 2.1.1 released with security fixes; reported by Zhang Zeyu
2022-05 - Debian LTS announcement published addressing the issue
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24761

Vulnerability Analysis

The vulnerability is an HTTP Request Smuggling flaw rooted in lax parsing of HTTP/1.1 framing headers. RFC 7230 mandates that Content-Length contain only digits and that chunked transfer encoding chunk sizes contain only hexadecimal digits. Waitress relied on Python's built-in int() function for these conversions, which accepts inputs such as +10, -0, and 0x01. A proxy that strictly conforms to RFC 7230 may reject or interpret these values differently than Waitress, producing a framing disagreement. The second class of issue involves chunk extensions: Waitress discarded them without validating their contents, allowing illegal characters to pass through the parser.

Root Cause

The parser used permissive integer conversion and skipped validation of chunk extension bytes. Both behaviors deviate from RFC 7230, which requires strict tokenization of framing metadata. The discrepancy between Waitress and the front-end proxy allowed two parties to disagree on the byte boundaries of the same request stream.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request through a vulnerable proxy. The proxy and Waitress interpret the framing fields differently, causing trailing bytes from the attacker's payload to be treated as the start of the next request. The smuggled request can target other users' connections, bypass proxy authentication, or poison shared caches. Exploitation requires no user interaction and no privileges on the target server.

text

2.1.1
-----

Security Bugfix
~~~~~~~~~~~~~~~

- Waitress now validates that chunked encoding extensions are valid, and don't
  contain invalid characters that are not allowed. They are still skipped/not
  processed, but if they contain invalid data we no longer continue in and
  return a 400 Bad Request. This stops potential HTTP desync/HTTP request
  smuggling. Thanks to Zhang Zeyu for reporting this issue.

- Waitress now validates that the chunk length is only valid hex digits when
  parsing chunked encoding, and values such as ``0x01`` and ``+01`` are no
  longer supported. This stops potential HTTP desync/HTTP request smuggling.

- Waitress now validates that the Content-Length sent by a remote contains only
  digits in accordance with RFC7230 and will return a 400 Bad Request when the
  Content-Length header contains invalid data, such as ``+10`` which would
  previously get parsed as ``10`` and accepted. This stops potential HTTP
  desync/HTTP request smuggling.

Source: Waitress security patch commit 9e0b8c8

Detection Methods for CVE-2022-24761

Indicators of Compromise

Requests where Content-Length headers contain non-digit characters such as +, -, leading zeros beyond a single 0, or 0x prefixes.
Chunked transfer encoding chunk size values containing non-hex characters or unusual chunk extensions following the size token.
Anomalous request boundaries in proxy logs where one client connection produces requests attributed to different sessions or users.
Unexpected 400 Bad Request responses from Waitress after upgrading, indicating previously accepted malformed traffic.

Detection Strategies

Inventory Python services to identify any Waitress deployment with version less than 2.1.1 via pip show waitress or container image scans.
Compare HTTP framing parsing between the front-end proxy and Waitress access logs to surface boundary disagreements.
Deploy a Web Application Firewall (WAF) rule that rejects requests where Content-Length or chunk size fields fail strict digit-only or hex-only validation.

Monitoring Recommendations

Forward proxy and application access logs to a centralized analytics platform and alert on malformed framing headers.
Monitor for sudden spikes in 400 Bad Request responses originating from Waitress after patching, which can indicate ongoing smuggling attempts.
Track outbound responses for cache poisoning indicators, such as one user receiving content intended for another.

How to Mitigate CVE-2022-24761

Immediate Actions Required

Upgrade Waitress to version 2.1.1 or later in all Python WSGI deployments.
For Debian systems, apply the updates referenced in DSA-5138 and the Debian LTS announcement.
Audit reverse proxy configurations to confirm strict RFC 7230 conformance is enabled where available.

Patch Information

The fix is delivered in Waitress 2.1.1, published as a security release on the Pylons project's GitHub. The patch enforces digit-only Content-Length parsing, hex-only chunk size parsing, and validation of chunk extension characters, returning 400 Bad Request on violations. Refer to the GitHub Security Advisory GHSA-4f7p-27jc-3c36 and the GitHub Release v2.1.1 for full details. Debian users should consult the Debian Security Advisory DSA-5138 and the Debian LTS Announcement May 2022.

Workarounds

Enable every available RFC 7230 strict-parsing option on the front-end proxy when an immediate upgrade is not possible.
Replace proxies that cannot enforce strict HTTP framing validation with implementations that can, then upgrade Waitress to 2.1.1 as the durable fix.
Add WAF rules that drop requests containing +, -, 0x, or whitespace inside Content-Length values and reject chunk sizes containing non-hexadecimal characters.

bash

# Upgrade Waitress to the patched release
pip install --upgrade 'waitress>=2.1.1'

# Verify installed version
python -c "import waitress; print(waitress.__version__)"

# Debian / Debian LTS
sudo apt-get update && sudo apt-get install --only-upgrade python3-waitress