vulnerability
Arch Linux: HTTP Request/Response Smuggling (CVE-2022-24761)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:N/I:P/A:N) | Mar 17, 2022 | Jul 11, 2025 | Nov 27, 2025 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
Mar 17, 2022
Added
Jul 11, 2025
Modified
Nov 27, 2025
Description
waitress behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 is vulnerable to request smuggling due to a disagreement between waitress and the proxy on where one request starts and where it ends.
Solution
arch-linux-upgrade-latest
References
- CVE-2022-24761
- https://attackerkb.com/topics/CVE-2022-24761
- URL-https://github.com/Pylons/waitress/commit/9e0b8c801e4d505c2ffc91b891af4ba48af715e0
- URL-https://github.com/Pylons/waitress/releases/tag/v2.1.1
- URL-https://github.com/Pylons/waitress/security/advisories/GHSA-4f7p-27jc-3c36
- URL-https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html
- URL-https://www.debian.org/security/2022/dsa-5138
- CWE-444
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.