CVE-2023-46136Medium· 5.7▾ TwilightPoC availableWerkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 31.4 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.1%
1 GitHub repo (last check)
Werkzeug multipart data parser needs to find a boundary that may be between consecutive chunks. That's why parsing is based on looking for newline characters. Unfortunately, code looking for partial boundary in the buffer is written inefficiently, so if we upload a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer.
This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.
werkzeug >= 3.0.0, < 3.0.1werkzeug >= 2.0.0rc1, < 2.3.8Upgrade to a patched release:
werkzeug 3.0.1werkzeug 2.3.8Connected by shared product, vendor, weakness, or advisory.
CVE-2024-49767High· 7.5Werkzeug possible resource exhaustion when parsing file data in forms
CVE-2026-27199MediumWerkzeug safe_join() allows Windows special device names
CVE-2019-14322High· 7.5Pallets Werkzeug vulnerable to Path Traversal
CVE-2024-34069High· 7.5Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
CVE-2023-25577High· 7.5High resource usage when parsing multipart form data with many fields
CVE-2023-23934Low· 2.6Incorrect parsing of nameless cookies leads to __Host- cookies bypass