Vulnerability · Published Oct 25, 2024 · Assigned by GitHub_M
CVE-2024-49767Werkzeug possible resource exhaustion when parsing file data in forms
Medium 6.9
In plain English
A medium-severity uncontrolled resource consumption in Quart from pallets. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | py3-werkzeug | 3.0.6-r0 | ALPINE-CVE-2024-49767 |
| Alpine:v3.21 | py3-werkzeug | 3.0.6-r0 | ALPINE-CVE-2024-49767 |
| Alpine:v3.22 | py3-werkzeug | 3.0.6-r0 | ALPINE-CVE-2024-49767 |
| Alpine:v3.23 | py3-werkzeug | 3.0.6-r0 | ALPINE-CVE-2024-49767 |
| Alpine:v3.24 | py3-werkzeug | 3.0.6-r0 | ALPINE-CVE-2024-49767 |
| Debian:12 | python-werkzeug | 2.2.2-3+deb12u1 | DEBIAN-CVE-2024-49767 |
| Debian:13 | python-werkzeug | 3.1.3-2 | DEBIAN-CVE-2024-49767 |
| Debian:14 | python-werkzeug | 3.1.3-2 | DEBIAN-CVE-2024-49767 |
| Debian:12 | quart | no fix listed | DEBIAN-CVE-2024-49767 |
| Debian:13 | quart | 0.19.9-1 | DEBIAN-CVE-2024-49767 |
| Debian:14 | quart | 0.19.9-1 | DEBIAN-CVE-2024-49767 |
| PyPI | quart | 0.20.0 | PYSEC-2026-1860 |
| PyPI | quart | 0.20.0 | GHSA-q34m-jh98-gwm2 |
| PyPI | werkzeug | 3.0.6 | PYSEC-2026-3417 |
| PyPI | werkzeug | 3.0.6 | GHSA-q34m-jh98-gwm2 |
| Ubuntu:22.04:LTS | python-werkzeug | 2.0.2+dfsg1-1ubuntu0.22.04.3 | USN-7093-1 |
| Ubuntu:22.04:LTS | python-werkzeug | 2.0.2+dfsg1-1ubuntu0.22.04.3 | UBUNTU-CVE-2024-49767 |
| Ubuntu:24.04:LTS | python-werkzeug | 3.0.1-3ubuntu0.2 | USN-7093-1 |
| Ubuntu:24.04:LTS | python-werkzeug | 3.0.1-3ubuntu0.2 | UBUNTU-CVE-2024-49767 |
| Ubuntu:22.04:LTS | quart | no fix listed | UBUNTU-CVE-2024-49767 |
| Ubuntu:24.04:LTS | quart | no fix listed | UBUNTU-CVE-2024-49767 |
| Ubuntu:25.10 | quart | no fix listed | UBUNTU-CVE-2024-49767 |
| Ubuntu:26.04:LTS | quart | no fix listed | UBUNTU-CVE-2024-49767 |
| Ubuntu:26.10 | quart | no fix listed | UBUNTU-CVE-2024-49767 |
Affected products (as reported)
Weakness: CWE-400, CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2 x_refsource_CONFIRM
- https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee x_refsource_MISC
- https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f x_refsource_MISC
- https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b x_refsource_MISC
- https://github.com/pallets/werkzeug/releases/tag/3.0.6 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20250103-0007/