Werkzeug may allow high resource usage when parsing multipart form data with many fields

CVE-2023-25577

What is CVE-2023-25577?

The Werkzeug library, a widely-used WSGI web application framework, suffers from a vulnerability in its multipart form data parser, which can lead to substantial resource consumption. Versions prior to 2.2.3 allow an attacker to send specially crafted multipart data to an endpoint that processes request.data, request.form, or request.files. By doing so, malicious actors can exploit the unlimited parsing of multipart parts, causing excessive CPU usage and potentially exhausting memory resources. This could lead to denial of service conditions, where legitimate requests cannot be processed efficiently, or even result in worker processes being killed due to out of memory errors. Users are strongly encouraged to upgrade to version 2.2.3 or later to mitigate the risk associated with this vulnerability.

References