Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2019-16785

26
FAUCET Score

CVE-2019-16785 is an HTTP request smuggling/splitting vulnerability in Waitress versions prior to 1.4.0, affecting products like Debian, Fedora, Oracle, and Red Hat. This flaw arises from Waitress's lenient parsing of line terminators (LF instead of CRLF), which can cause a mismatch in how front-end and back-end servers interpret HTTP messages. With a CVSS score of 7.5 (High), this vulnerability allows unauthenticated attackers to manipulate HTTP requests, potentially leading to data manipulation (I:H) without requiring user interaction. There is no evidence of active exploitation, and no public exploit code or significant community discussion has been identified.

Impacted Technologies

VendorProductVersion(s)CPE
<= 1.3.1CPE matchmatch criteria
cpe:2.3:a:agendaless:waitress:*:*:*:*:*:*:*:*
1.10.0CPE matchmatch criteria
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
30CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
31CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.1HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
1.8
Impact Score
4.7
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.71%
Probability of exploitation in next 30 days
EPSS Percentile
84.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0271 is in the 72nd percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (19)

github_advisorypatch availablevia nvd_reference
View patch
oraclepatch availablevia nvd_reference
View patch
pippatch availablevia ghsa
Product: waitressFixed in: 1.4.0
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-bridge-operator-bundle:v3.4.0-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-bridge-operator-rhel8:v3.4.0-17
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-builder-qemu-rhcos-rhel8:v3.4.0-17
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-builder-rhel8:v3.4.0-18
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-container-security-operator-rhel8:v3.4.0-2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-openshift-bridge-rhel8-operator:v3.4.0-17
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-operator-bundle:v3.4.0-89
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-operator-rhel8:v3.4.0-132
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-rhel8:v3.4.0-51
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-container-security-operator-bundle:v3.4.0-2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 15.0 (Stein)Fixed in: python-waitress-0:1.4.2-1.el8ost
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/clair-rhel8:v3.4.0-25
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat Ceph Storage 3Fixed in: python-waitress
redhatvendor investigatingvia redhat_api
Product: Red Hat Ceph Storage 4Fixed in: python-waitress
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 16 (Train)Fixed in: python-waitress
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 13 (Queens)Fixed in: python-waitress

Vendor Advisories (2)

pipGHSA-pg36-wpm5-g57pmedium

HTTP Request Smuggling: LF vs CRLF handling in Waitress

Dec 20, 2019
redhatCVE-2019-16785Important

waitress: HTTP request smuggling through LF vs CRLF handling

Dec 20, 2019

References

access.redhat.com / errata/RHSA-2020:0720
Third Party Advisory
docs.pylonsproject.org / projects/waitress/en/latest
Vendor Advisory
github.com / Pylons/waitress/commit/8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba
PatchThird Party Advisory
github.com / Pylons/waitress/security/advisories/GHSA-pg36-wpm5-g57p
ExploitThird Party Advisory
lists.debian.org / debian-lts-announce/2022/05/msg00011.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5
oracle.com / security-alerts/cpuapr2022.html
PatchThird Party Advisory