CVE-2024-49767

Published: Oct 25, 2024Modified: Jun 17, 2026

6.9

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.

Affected (2)

Products: Palletsprojects: Quart, Werkzeug

Palletsprojects

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Palletsprojects Quart	Before 0.19.7
Palletsprojects Werkzeug	Before 3.0.6

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (6)

https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee

Source: security-advisories@github.com

Patch

https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f

Source: security-advisories@github.com

https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b

Source: security-advisories@github.com

Patch

https://github.com/pallets/werkzeug/releases/tag/3.0.6

Source: security-advisories@github.com

Release Notes

https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2

Source: security-advisories@github.com

Vendor Advisory

https://security.netapp.com/advisory/ntap-20250103-0007/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.