CVE-2024-49767 Werkzeug possible resource exhaustion when parsing file data in forms
Attackers can cause resource exhaustion and denial of service by sending crafted multipart form data to applications using the Werkzeug library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49767?
CVE-2024-49767 is a medium-severity denial of service vulnerability in pallets Quart, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
Which versions are affected by CVE-2024-49767?
6 open source packages ship an affected version, including quart, Quart and Werkzeug. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
quart PyPI | All versions | 0.20.0 |
quart PyPI | All versions | 0.20.0 |
Quart PyPI | All versions | 0.20.0 |
Werkzeug PyPI | From 2.0.0rc1 | 3.0.6 |
werkzeug PyPI | From 2.0.0rc1 | 3.0.6 |
werkzeug PyPI | From 2.0.0rc1 | 3.0.6 |
Linux distribution packages (5)
python-Werkzeug SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 2.3.6-150400.6.12.1 |
python-Werkzeug SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 2.3.6-150400.6.12.1 |
python-Werkzeug openSUSE:Leap 15.5 | All versions | 2.3.6-150400.6.12.1 |
python-Werkzeug openSUSE:Leap 15.6 | All versions | 2.3.6-150400.6.12.1 |
python-Werkzeug openSUSE:Tumbleweed | All versions | 3.0.6-1.1 |
Products include Palletsprojects Quart, Palletsprojects Werkzeug.
How do I fix CVE-2024-49767?
Upgrade quart to 0.20.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-49767 being exploited?
There is no known exploitation of CVE-2024-49767 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-49767, AZL-51690, AZL-51723, BELL-CVE-2024-49767, CLEANSTART-2026-PR62094, CLEANSTART-2026-QY47175 and 16 more.