Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
CVE-2023-46136
Key Information:
Badges
What is CVE-2023-46136?
A design flaw in the Werkzeug library allows an attacker to exploit a multipart data upload that begins with carriage return (CR) or line feed (LF) characters followed by significant amounts of additional data. This attack creates a situation where internal bytearrays grow substantially, leading to increased CPU consumption that severely inhibits the ability of worker processes to handle legitimate requests. As a result, this vulnerability can disrupt the availability of services relying on the Werkzeug framework. The issue has been resolved in version 3.0.1.
Affected Version(s)
werkzeug < 3.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.