CVE-2024-49767
Description
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
How to fix
- palletsprojects werkzeug3.0.6 or later
- palletsprojects quart0.19.7 or later
- werkzeug3.0.6 or later
- quart0.20.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| palletsprojects werkzeug | v < 3.0.6 | 3.0.6 |
| palletsprojects quart | v < 0.19.7 | 0.19.7 |
| werkzeugPyPI | 2.0.0rc1 ≤ v < 3.0.6 | 3.0.6 |
| quartPyPI | v < 0.20.0 | 0.20.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.