PT-2023-2540 · Werkzeug+6 · Werkzeug+6
Das7Pad
·
Published
2023-02-14
·
Updated
2026-01-22
·
CVE-2023-25577
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Werkzeug versions prior to 2.2.3
Description
The issue is related to the multipart form data parser in Werkzeug, which can parse an unlimited number of parts, including file parts. This can cause unexpectedly high resource usage if a request is made to an endpoint that accesses
request.data, request.form, request.files, or request.get data(parse form data=False). An attacker can exploit this to cause a denial of service by sending crafted multipart data to an endpoint that will parse it, potentially blocking worker processes from handling legitimate requests, triggering an out of memory kill of the process, or exhausting available workers.Recommendations
For versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to endpoints that parse multipart form data to minimize the risk of exploitation. Avoid using the
request.data, request.form, request.files, or request.get data(parse form data=False) variables in affected API endpoints until the issue is resolved.Exploit
Fix
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Werkzeug