CVE-2024-49767
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-49767
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49767.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-49767
- Aliases
- Downstream
- Related
- Published
- 2024-10-25T19:41:35Z
- Modified
- 2025-10-15T14:59:47.005270Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Werkzeug possible resource exhaustion when parsing file data in forms
- Details
-
Werkzeug is a Web Server Gateway Interface web application library. Applications using
werkzeug.formparser.MultiPartParsercorresponding to a version of Werkzeug prior to 3.0.6 to parsemultipart/form-datarequests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue. - References
-
- https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2
- https://security.netapp.com/advisory/ntap-20250103-0007/
- https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee
- https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f
- https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b
- https://github.com/pallets/werkzeug/releases/tag/3.0.6
Affected packages
Git / github.com/pallets/werkzeug
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pallets/werkzeug
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
0.*
0.1
0.10
0.10.1
0.10.2
0.10.3
0.10.4
0.11
0.11.1
0.11.10
0.11.11
0.11.12
0.11.13
0.11.14
0.11.15
0.11.2
0.11.3
0.11.4
0.11.5
0.11.6
0.11.7
0.11.8
0.11.9
0.12
0.12.1
0.12.2
0.13
0.14
0.14.1
0.14.x
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.x
0.16.0
0.16.1
0.16.x
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.5.1
0.6
0.6.1
0.6.2
0.7
0.8
0.8.1
0.8.2
0.8.3
0.9
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
1.*
1.0.0
1.0.0rc1
1.0.1
1.0.x
2.*
2.0.0
2.0.0rc1
2.0.0rc2
2.0.0rc3
2.0.0rc4
2.0.0rc5
2.0.1
2.0.2
2.0.3
2.0.x
2.1.0
2.1.1
2.1.2
2.1.x
2.2.0
2.2.0a1
2.2.1
2.2.2
2.2.3
2.2.x
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.x
3.*
3.0.2
3.0.3
3.0.4
3.0.5
Git / github.com/pallets/werkzeug
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pallets/werkzeug
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
0.*
0.1
0.10
0.10.1
0.10.2
0.10.3
0.10.4
0.11
0.11.1
0.11.10
0.11.11
0.11.12
0.11.13
0.11.14
0.11.15
0.11.2
0.11.3
0.11.4
0.11.5
0.11.6
0.11.7
0.11.8
0.11.9
0.12
0.12.1
0.12.2
0.13
0.14
0.14.1
0.14.x
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.x
0.16.0
0.16.1
0.16.x
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.5.1
0.6
0.6.1
0.6.2
0.7
0.8
0.8.1
0.8.2
0.8.3
0.9
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
1.*
1.0.0
1.0.0rc1
1.0.1
1.0.x
2.*
2.0.0
2.0.0rc1
2.0.0rc2
2.0.0rc3
2.0.0rc4
2.0.0rc5
2.0.1
2.0.2
2.0.3
2.0.x
2.1.0
2.1.1
2.1.2
2.1.x
2.2.0
2.2.0a1
2.2.1
2.2.2
2.2.3
2.2.x
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.x
3.*
3.0.2
3.0.3
3.0.4
3.0.5