p PatchFirst

CVE-2024-49767

CVE-2024-49767 · Werkzeug possible resource exhaustion when parsing file data in forms

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.

CVSS 6.9 · Medium · EPSS 1.1% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • werkzeug

    Versions
    • >= 2.0.0rc1, < 3.0.6: Affected

    No fix published

  • quart

    Versions
    • < 0.20.0: Affected

    No fix published

  • python-werkzeug Debian:12

    Versions
    • 2.2.2-3
    Affected ranges
    • ECOSYSTEM: < 2.2.2-3+deb12u1

    Update to 2.2.2-3+deb12u1

  • python-werkzeug Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.1.3-2

    Update to 3.1.3-2

  • python-werkzeug Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.1.3-2

    Update to 3.1.3-2

  • quart Debian:12

    Versions
    • 0.18.3-2
    • 0.19.4-1
    • 0.19.4-2
    • 0.19.5-1
    • 0.19.6-1
    • 0.19.9-1
    • 0.20.0-1
    • 0.20.0-2
    • 0.20.0-3
    • 0.20.0-4
    • 0.20.0-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • quart Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.19.9-1

    Update to 0.19.9-1

  • quart Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.19.9-1

    Update to 0.19.9-1

  • werkzeug PyPI

    Versions
    • 2.0.0
    • 2.0.0rc1
    • 2.0.0rc2
    • 2.0.0rc3
    • 2.0.0rc4
    • 2.0.0rc5
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.2.0
    • 2.2.0a1
    • 2.2.1
    • 2.2.2
    • 2.2.3
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.3.5
    • 2.3.6
    • 2.3.7
    • 2.3.8
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0rc1, < 3.0.6

    Update to 3.0.6

  • quart PyPI

    Versions
    • 0.1.0
    • 0.10.0
    • 0.11.0
    • 0.11.1
    • 0.11.2
    • 0.11.3
    • 0.11.4
    • 0.11.5
    • 0.12.0
    • 0.13.0
    • 0.13.1
    • 0.14.0
    • 0.14.1
    • 0.15.0
    • 0.15.1
    • 0.16.0
    • 0.16.1
    • 0.16.2
    • 0.16.3
    • 0.17.0
    • 0.18.0
    • 0.18.1
    • 0.18.2
    • 0.18.3
    • 0.18.4
    • 0.19.0
    • 0.19.1
    • 0.19.2
    • 0.19.3
    • 0.19.4
    • 0.19.5
    • 0.19.6
    • 0.19.7
    • 0.19.8
    • 0.19.9
    • 0.2.0
    • 0.3.0
    • 0.3.1
    • 0.4.0
    • 0.4.1
    • 0.5.0
    • 0.6.0
    • 0.6.1
    • 0.6.10
    • 0.6.11
    • 0.6.12
    • 0.6.13
    • 0.6.14
    • 0.6.15
    • 0.6.2
    • 0.6.3
    • 0.6.4
    • 0.6.5
    • 0.6.6
    • 0.6.7
    • 0.6.8
    • 0.6.9
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 0.9.1
    Affected ranges
    • ECOSYSTEM: < 0.20.0

    Update to 0.20.0

  • python-werkzeug Ubuntu:22.04:LTS

    Versions
    • 1.0.1+dfsg1-2
    • 2.0.2+dfsg1-1
    • 2.0.2+dfsg1-1ubuntu0.22.04.1
    • 2.0.2+dfsg1-1ubuntu0.22.04.2
    Affected ranges
    • ECOSYSTEM: < 2.0.2+dfsg1-1ubuntu0.22.04.3

    Update to 2.0.2+dfsg1-1ubuntu0.22.04.3

  • quart Ubuntu:22.04:LTS

    Versions
    • 0.14.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-werkzeug Ubuntu:24.04:LTS

    Versions
    • 2.2.2-3
    • 3.0.1-1
    • 3.0.1-2
    • 3.0.1-3
    • 3.0.1-3ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 3.0.1-3ubuntu0.2

    Update to 3.0.1-3ubuntu0.2

  • quart Ubuntu:24.04:LTS

    Versions
    • 0.18.3-2
    • 0.19.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • quart Ubuntu:25.10

    Versions
    • 0.20.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • quart Ubuntu:26.10

    Versions
    • 0.20.0-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • quart Ubuntu:26.04:LTS

    Versions
    • 0.20.0-1
    • 0.20.0-3
    • 0.20.0-4
    • 0.20.0-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →