Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

CVE-2023-46136

What is CVE-2023-46136?

A design flaw in the Werkzeug library allows an attacker to exploit a multipart data upload that begins with carriage return (CR) or line feed (LF) characters followed by significant amounts of additional data. This attack creates a situation where internal bytearrays grow substantially, leading to increased CPU consumption that severely inhibits the ability of worker processes to handle legitimate requests. As a result, this vulnerability can disrupt the availability of services relying on the Werkzeug framework. The issue has been resolved in version 3.0.1.

References