CVE-2024-49767High· 7.5▾ TwilightWerkzeug possible resource exhaustion when parsing file data in forms
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
1.1%
1.1% → 1.1%
Last analysed / modified upstream
Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max_form_memory_size setting.
The Request.max_content_length setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
werkzeug >= 2.0.0rc1, < 3.0.6quart < 0.20.0Upgrade to a patched release:
werkzeug 3.0.6quart 0.20.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-46136Medium· 5.7Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
CVE-2024-49766MediumWerkzeug safe_join not safe on Windows
CVE-2023-25577High· 7.5High resource usage when parsing multipart form data with many fields
CVE-2023-23934Low· 2.6Incorrect parsing of nameless cookies leads to __Host- cookies bypass
CVE-2026-27199MediumWerkzeug safe_join() allows Windows special device names
CVE-2019-14322High· 7.5Pallets Werkzeug vulnerable to Path Traversal