{
  "cveId": "CVE-2024-49769",
  "url": "https://patchblox.com/security/cve/CVE-2024-49769",
  "summary": "CVE-2024-49769 is fixed in 4 products on 1 platform, first by python3-waitress 1.4.1-1ubuntu0.2, released October 29, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "python3-waitress: Waitress is a Web Server Gateway Interface server for Python 2 and 3",
  "description": "Waitress is a Web Server Gateway Interface server for Python 2 and 3. Whena remote client closes the connection before waitress has had theopportunity to call getpeername() waitress won\u0027t correctly clean up theconnection leading to the main thread attempting to write to a socket thatno longer exists, but not removing it from the list of sockets to attemptto process. This leads to a busy-loop calling the write function. A remoteattacker could run waitress out of available sockets with very littleresources required. Waitress 3.0.1 contains fixes that remove the racecondition.",
  "published": "2024-10-29T08:15:00Z",
  "severity": "Medium",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.01377,
  "epssPercentile": 0.72224,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-waitress",
      "release": "sles 15.6",
      "fixedVersion": "1.4.3-150000.3.9.1",
      "fix": "SUSE-SU-2024:4107-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4107-1",
      "released": "2024-11-28T15:12:34Z"
    },
    {
      "platform": "linux",
      "product": "python-waitress-doc",
      "release": "sles 15.6",
      "fixedVersion": "2.1.2-150400.12.7.1",
      "fix": "SUSE-SU-2024:3876-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3876-1",
      "released": "2024-11-01T15:29:32Z"
    },
    {
      "platform": "linux",
      "product": "python3-waitress",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.4.1-1ubuntu0.2",
      "fix": "python3-waitress 1.4.1-1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-waitress-1.4.1-1ubuntu0.2",
      "released": "2024-10-29T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-waitress",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.4.4-1.1ubuntu1.1",
      "fix": "python3-waitress 1.4.4-1.1ubuntu1.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-waitress-1.4.4-1.1ubuntu1.1",
      "released": "2024-10-29T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-waitress",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.1.2-2ubuntu0.1~esm1",
      "fix": "python3-waitress 2.1.2-2ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-waitress-2.1.2-2ubuntu0.1-esm1",
      "released": "2024-10-29T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-waitress",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "3.0.0-1ubuntu0.1",
      "fix": "python3-waitress 3.0.0-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-python3-waitress-3.0.0-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "python3-waitress",
      "release": "amzn 2023",
      "fixedVersion": "2.1.2-1.amzn2023.0.3",
      "fix": "ALAS2023-2024-773",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2024-773",
      "released": "2024-12-05T20:34:00Z"
    },
    {
      "platform": "linux",
      "product": "waitress",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "1.4.4-1.1\u002Bdeb11u2",
      "fix": "DLA-3955-1",
      "url": "https://patchblox.com/security/fix/linux/dla-3955-1",
      "released": "2024-11-16T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "waitress",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.1.2-2\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2024-49769",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-49769",
      "released": "2024-10-29T15:15:12Z"
    },
    {
      "platform": "linux",
      "product": "waitress",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.0.1-1",
      "fix": "DEBIAN-CVE-2024-49769",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-49769",
      "released": "2024-10-29T15:15:12Z"
    },
    {
      "platform": "linux",
      "product": "waitress",
      "release": "Debian 14",
      "fixedVersion": "3.0.1-1",
      "fix": "DEBIAN-CVE-2024-49769",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-49769",
      "released": "2024-10-29T15:15:12Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}