CVE-2024-49767
highpriority · track · 30EPSS 0.011 · 65 %ileDEEUNLRUUSEPSS · scored 2026-10-22
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.7–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (263)
Products and version ranges known to be affected.
advisories (9)
Vendor and ecosystem advisories describing this.
- NCSC-2025-0021Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communicatieproducten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Network Function en Oracle Communications Order and Service Management.
- NCSC-2025-0124Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-04-16csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Communications producten, waaronder de Cloud Native Core en Policy Management.
- WID-SEC-W-2024-3614IBM InfoSphere Information Server: Mehrere SchwachstellenDeutsch2024-12-04csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.
- WID-SEC-W-2025-0148Oracle Communications: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-0823Oracle Communications: Mehrere SchwachstellenDeutsch2025-04-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-1559Oracle Communications: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-q34m-jh98-gwm2Werkzeug possible resource exhaustion when parsing file data in forms2024-10-25ghsa · osvUS
Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting. The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
- PYSEC-2026-1860Werkzeug possible resource exhaustion when parsing file data in forms2026-07-07vendor · osvUS
Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting. The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
- PYSEC-2026-3417Werkzeug possible resource exhaustion when parsing file data in forms2026-07-13vendor · osvUS
Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting. The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
also known as (9)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (20)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-49767cnnvd
- https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644eecnnvd
- https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179bcnnvd
- https://github.com/pallets/werkzeug/releases/tag/3.0.6cnnvd
- https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2cnnvd
- https://vigilance.fr/vulnerability/Werkzeug-overload-via-multipart-form-data-45494cnnvd
- https://www.oracle.com/security-alerts/cpuapr2025.htmlcnnvd
- https://www.oracle.com/security-alerts/cpujan2025.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan