CVE-2023-25577 Werkzeug may allow high resource usage when parsing multipart form data with many fields

What is CVE-2023-25577?

CVE-2023-25577 is a high-severity denial of service vulnerability in pallets werkzeug, published on 14 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.

Weakness: CWE-770

Which versions are affected by CVE-2023-25577?

3 open source packages ship an affected version, including werkzeug and Werkzeug. It affects 1 product.

Products include Palletsprojects Werkzeug.

How do I fix CVE-2023-25577?

Upgrade werkzeug to 2.2.3 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-25577 being exploited?

There is no known exploitation of CVE-2023-25577 in the wild and no public exploit code.

Other vulnerabilities in pallets werkzeug

• CVE-2022-29361 Other in n/a Critical 9.8
• CVE-2023-46136 Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning High 8.0
• CVE-2019-14322 Pallets Werkzeug vulnerable to Path Traversal High 7.5
• CVE-2026-27199 Werkzeug safe_join() allows Windows special device names Medium 6.3
• CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-13588, DEBIAN-CVE-2023-25577, GHSA-xg9f-g7g7-2323, PYSEC-2023-58, RHBA-2023:1507, RHBA-2023:1759 and 7 more.