CVE-2022-24761

CVE-2022-24761 is a request smuggling vulnerability affecting Waitress versions 2.1.0 and prior, a Web Server Gateway Interface server for Python. When Waitress is deployed behind a proxy that does not strictly validate HTTP requests against RFC7230, an attacker can manipulate requests, leading to disagreement between the proxy and Waitress on request boundaries. This allows for request smuggling, potentially bypassing security controls. The vulnerability has a CVSS score of 7.5 (High), indicating it can be exploited remotely with low attack complexity, requiring no user interaction, and can lead to high integrity impact. The root cause involves Waitress's parsing of integer strings and its handling of chunk extensions. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness or active threat intelligence.