CVE-2023-46136 Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
Attackers can cause denial of service in applications using Werkzeug by sending crafted multipart data that consumes excessive CPU resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46136?
CVE-2023-46136 is a high-severity denial of service vulnerability in pallets werkzeug, published on 24 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1 and 2.3.8.
Which versions are affected by CVE-2023-46136?
5 open source packages ship an affected version, including werkzeug and Werkzeug. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
werkzeug PyPI | All versions | 2.3.8, 3.0.1 |
werkzeug PyPI | From 2.0.0rc1 | 2.3.8 |
werkzeug PyPI | From 3.0.0 | 3.0.1 |
Werkzeug PyPI | From 2.0.0rc1 | 2.3.8 |
Werkzeug PyPI | From 3.0.0 | 3.0.1 |
Linux distribution packages (11)
python-werkzeug Red Hat:openshift_ironic:4.13::el9 | All versions | 0:2.0.3-5.el9 |
python3-werkzeug Red Hat:openshift_ironic:4.13::el9 | All versions | 0:2.0.3-5.el9 |
python-werkzeug Red Hat:openstack:17.1::el8 | All versions | 0:2.0.1-8.el8ost |
python3-werkzeug Red Hat:openstack:17.1::el8 | All versions | 0:2.0.1-8.el8ost |
python-werkzeug Red Hat:openstack:17.1::el9 | All versions | 0:2.0.1-6.el9ost |
python3-werkzeug Red Hat:openstack:17.1::el9 | All versions | 0:2.0.1-6.el9ost |
python-Werkzeug SUSE:Linux Enterprise Module for Python 3 15 SP4 | All versions | 2.3.6-150400.6.6.1 |
python-Werkzeug SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 2.3.6-150400.6.6.1 |
python-Werkzeug openSUSE:Leap 15.4 | All versions | 2.3.6-150400.6.6.1 |
python-Werkzeug openSUSE:Leap 15.5 | All versions | 2.3.6-150400.6.6.1 |
python-Werkzeug openSUSE:Tumbleweed | All versions | 3.0.1-1.1 |
Products include Palletsprojects Werkzeug.
How do I fix CVE-2023-46136?
Upgrade werkzeug to a fixed version for your release line: 2.3.8 or 3.0.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-46136 being exploited?
There is no known exploitation of CVE-2023-46136 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in pallets werkzeug
- CVE-2022-29361 Other in n/a
- CVE-2023-25577 Werkzeug may allow high resource usage when parsing multipart form data with many fields
- CVE-2019-14322 Pallets Werkzeug vulnerable to Path Traversal
- CVE-2026-27199 Werkzeug safe_join() allows Windows special device names
- CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions
Sources
Also known as ALPINE-CVE-2023-46136, AZL-31701, AZL-35141, CLEANSTART-2026-PT44731, CLEANSTART-2026-TF19359, CLSA-2026-1773360968 and 16 more.