CVE-2024-49767: Werkzeug possible resource exhaustion when parsing file data in forms
Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.maxformmemorysize setting.
The Request.maxcontentlength setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
Other sources
Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no uppe
— IBM
Werkzeug possible resource exhaustion when parsing file data in forms
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49767?
CVE-2024-49767 is classified as a moderate severity vulnerability due to potential resource exhaustion.
How do I fix CVE-2024-49767?
To address CVE-2024-49767, upgrade to Quart version 0.20.0 or Werkzeug version 3.0.6 or later.
What applications are affected by CVE-2024-49767?
CVE-2024-49767 affects applications that use Werkzeug and Quart versions up to specific thresholds as noted in the affected software list.
Can CVE-2024-49767 impact my application's performance?
Yes, exploited properly, CVE-2024-49767 can lead to significant performance degradation or denial of service due to resource exhaustion.
Is my deployment at risk with CVE-2024-49767?
If you are using affected versions of Werkzeug or Quart, your deployment could be at risk for CVE-2024-49767 if proper mitigations are not in place.