---
title: "CVE-2020-5236\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2020-5236?format=md
keywords: index, follow
---

# CVE-2020-5236

Publication date 4 February 2020

Last updated 25 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**6.5 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2020-5236?format=md#impact-score)

Toggle side navigation

## Description

Waitress version 1.4.2 allows a DOS attack When waitress receives a header
that contains invalid characters. When a header like "Bad-header:
xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression
engine to catastrophically backtrack causing the process to use 100% CPU
time and blocking any other interactions. This allows an attacker to send a
single request with an invalid header and take the service offline. This
issue was introduced in version 1.4.2 when the regular expression was
updated to attempt to match the behaviour required by errata associated
with RFC7230. The regular expression that is used to validate incoming
headers has been updated in version 1.4.3, it is recommended that people
upgrade to the new version of Waitress as soon as possible.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2020-5236?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| waitress | 19.10 eoan | Not affected |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not affected |
| 14.04 LTS trusty | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2020-5236?format=md#patch-details)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

introduced in 1.4.2

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| waitress | * Upstream:   [6e46f9e](https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1f) |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

6.5 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | Low |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | None |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 6.5 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5236)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-5236)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2020-5236)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2020-5236)

### Other references

* <https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgc>
* <https://www.cve.org/CVERecord?id=CVE-2020-5236>