CVE-2023-25577
highpriority · track · 30EPSS 0.014 · 73 %ileDEEURUUSEPSS · scored 2026-10-27
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.7–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (39)
Products and version ranges known to be affected.
- Dell PowerProtect Data Domain Management Centerall versionscert_bundDEcpe:/a:dell:powerprotect_data_domain_management_center:-
advisories (6)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-0402xpdf: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2023-02-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in xpdf ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2023-1021Oracle Communications: Mehrere SchwachstellenDeutsch2023-04-18csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1497IBM Spectrum Protect: Mehrere SchwachstellenDeutsch2023-06-18csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um einen Denial of Service Angriff durchzuführen, Dateien zu manipulieren oder Informationen offenzulegen.
- WID-SEC-W-2024-3377Dell PowerProtect Data Domain: Mehrere SchwachstellenDeutsch2024-11-07csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain ausnutzen, um seine Privilegien zu erhöhen, Informationen offenzulegen und um nicht näher beschriebene Auswirkungen zu erzielen.
- GHSA-xg9f-g7g7-2323High resource usage when parsing multipart form data with many fields2023-02-15ghsa · osvUS
Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.
- PYSEC-2023-582023-02-14vendor · osvUS
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (24)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-25577/cnnvd
- https://github.com/pallets/werkzeug/commit/517cac5a804e8c4dc4ed038bb20dacd038e7a9f1cnnvd
- https://github.com/pallets/werkzeug/releases/tag/2.2.3cnnvd
- https://github.com/pallets/werkzeug/security/advisories/GHSA-xg9f-g7g7-2323cnnvd
- https://security.netapp.com/advisory/ntap-20230818-0003/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.1259cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.1534cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.2034cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan