Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
CVE-2023-46136
Key Information:
Badges
What is CVE-2023-46136?
A design flaw in the Werkzeug library allows an attacker to exploit a multipart data upload that begins with carriage return (CR) or line feed (LF) characters followed by significant amounts of additional data. This attack creates a situation where internal bytearrays grow substantially, leading to increased CPU consumption that severely inhibits the ability of worker processes to handle legitimate requests. As a result, this vulnerability can disrupt the availability of services relying on the Werkzeug framework. The issue has been resolved in version 3.0.1.
Affected Version(s)
werkzeug >= 3.0.0, < 3.0.1 < 3.0.0, 3.0.1
werkzeug >= 2.0.0rc1, < 2.3.8 < 2.0.0rc1, 2.3.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.