CVE-2022-29361 Other in n/a

What is CVE-2022-29361?

CVE-2022-29361 is a critical vulnerability in n/a, published on 24 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project

Weakness: CWE-444

Which versions are affected by CVE-2022-29361?

1 open source package ship an affected version, including werkzeug. It affects 1 product.

Products include Palletsprojects Werkzeug.

How do I fix CVE-2022-29361?

Upgrade werkzeug to 2.1.1 or later.

Is CVE-2022-29361 being exploited?

There is no known exploitation of CVE-2022-29361 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2023-46136 Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning High 8.0
• CVE-2023-25577 Werkzeug may allow high resource usage when parsing multipart form data with many fields High 7.5
• CVE-2019-14322 Pallets Werkzeug vulnerable to Path Traversal High 7.5
• CVE-2026-27199 Werkzeug safe_join() allows Windows special device names Medium 6.3
• CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2022-29361, GHSA-7wxw-4483-3m34, PYSEC-2022-203, openSUSE-SU-2024:13098-1.