Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
References
Configurations
Configuration 1 (hide)
|
History
03 Jan 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Dec 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-400 |
|
| References |
|
05 Nov 2024, 20:03
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* cpe:2.3:a:palletsprojects:quart:*:*:*:*:*:python:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Palletsprojects
Palletsprojects werkzeug Palletsprojects quart |
|
| References | () https://github.com/pallets/werkzeug/releases/tag/3.0.6 - Release Notes | |
| References | () https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b - Patch | |
| References | () https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2 - Vendor Advisory | |
| References | () https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee - Patch |
25 Oct 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-25 20:15
Updated : 2025-01-03 12:15
NVD link : CVE-2024-49767
Mitre link : CVE-2024-49767
JSON object : View
Products Affected
palletsprojects
- werkzeug
- quart
CWE
No CWE.