Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Pylons — Vulnerabilities & Security Advisories 13

Browse all 13 CVE security advisories affecting Pylons. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Pylons is a Python web framework used for building web applications and APIs. Historically, it has been susceptible to remote code execution, cross-site scripting, and privilege escalation vulnerabilities, often stemming from improper input validation and insecure default configurations. While no major public security incidents have been widely documented, the 12 recorded CVEs highlight consistent security concerns, particularly in versions prior to 1.0. Developers should implement strict input sanitization, update regularly, and follow secure coding practices to mitigate risks associated with this framework.

CVE IDTitleCVSSSeverityPublished
CVE-2026-44889 WebOb: Location header normalization during redirect leads to open redirect — webobCWE-601 6.1 Medium2026-06-22
CVE-2024-49768 Waitress has request processing race condition in HTTP pipelining with invalid first request — waitressCWE-367 9.1 Critical2024-10-29
CVE-2024-49769 Waitress has a denial of service leading to high CPU usage/resource exhaustion — waitressCWE-772 7.5 High2024-10-29
CVE-2024-42353 WebOb's location header normalization during redirect leads to open redirect — webobCWE-601 6.1 Medium2024-08-14
CVE-2023-40587 Pyramid static view path traversal up one directory — pyramidCWE-22 4.3 Medium2023-08-25
CVE-2014-125056 Pylons horus services.py timing discrepancy — horusCWE-208 2.6 Low2023-01-07
CVE-2022-31015 Uncaught Exception (due to a data race) leads to process termination in Waitress — waitressCWE-248 6.5 Medium2022-05-31
CVE-2022-24761 HTTP Request Smuggling in waitress — waitressCWE-444 7.5 High2022-03-17
CVE-2020-5236 Catastrophic backtracking in regex allows Denial of Service in Waitress — WaitressCWE-400 5.7 Medium2020-02-04
CVE-2019-16792 HTTP Request Smuggling: Content-Length Sent Twice in Waitress — WaitressCWE-444 7.1 High2020-01-22
CVE-2019-16789 HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers — WaitressCWE-444 7.1 High2019-12-26
CVE-2019-16785 HTTP Request Smuggling: LF vs CRLF handling in Waitress — WaitressCWE-444 7.1 High2019-12-20
CVE-2019-16786 HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress — WaitressCWE-444 7.1 High2019-12-20

This page lists every published CVE security advisory associated with Pylons. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.