cve/2019/CVE-2019-16792.md

### [CVE-2019-16792](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16792)
![](https://img.shields.io/static/v1?label=Product&message=Waitress&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%201.3.1%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-444%20Inconsistent%20Interpretation%20of%20HTTP%20Requests%20('HTTP%20Request%20Smuggling')&color=brightgreen)

### Description

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

### POC

#### Reference
- https://www.oracle.com/security-alerts/cpuapr2022.html

#### Github
No PoCs found on GitHub currently.