Werkzeug may allow high resource usage when parsing multipart form data with many fields

CVE-2023-25577

What is CVE-2023-25577?

The Werkzeug library, a widely-used WSGI web application framework, suffers from a vulnerability in its multipart form data parser, which can lead to substantial resource consumption. Versions prior to 2.2.3 allow an attacker to send specially crafted multipart data to an endpoint that processes request.data, request.form, or request.files. By doing so, malicious actors can exploit the unlimited parsing of multipart parts, causing excessive CPU usage and potentially exhausting memory resources. This could lead to denial of service conditions, where legitimate requests cannot be processed efficiently, or even result in worker processes being killed due to out of memory errors. Users are strongly encouraged to upgrade to version 2.2.3 or later to mitigate the risk associated with this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References