Werkzeug possible resource exhaustion when parsing file data in forms
Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max_form_memory_size setting.
The Request.max_content_length setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | quart | < 0.20.0 | 0.20.0 |
| Python (PyPI) | werkzeug | >= 2.0.0rc1, < 3.0.6 | 3.0.6 |
Referencias
- https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2
- https://nvd.nist.gov/vuln/detail/CVE-2024-49767
- https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee
- https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f
- https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b
- https://github.com/pallets/werkzeug/commit/cbb446fdcada7685fce936ded01b76c08dbd6eb5
- https://github.com/pallets/werkzeug
- https://github.com/pallets/werkzeug/releases/tag/3.0.6
- https://security.netapp.com/advisory/ntap-20250103-0007
- https://pypi.org/project/quart
- https://github.com/advisories/GHSA-q34m-jh98-gwm2
- https://pypi.org/project/werkzeug
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Debilidad (CWE)
CWE-400- Plataforma
- Python (PyPI)
- Paquete
quart, werkzeug- Publicada
- 25.10.2024
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-1860 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-3417 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-q34m-jh98-gwm2 - CC BY 4.0
Historial de vulnerabilidades: quart
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 2
- Primera → última
- 10.2024 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 1
- Media 1
Divulgaciones por año
- 2024: 1
- 2025: 0
- 2026: 1
-
Werkzeug possible resource exhaustion when parsing file data in forms esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.