Werkzeug Web Server Gateway Interface Vulnerability: Denial of Service Attack via Maliciously Formatted Submission

CVE-2024-49767

What is CVE-2024-49767?

The vulnerability in Werkzeug affects applications utilizing the werkzeug.formparser.MultiPartParser for handling multipart/form-data requests. Specifically, versions of Werkzeug prior to 3.0.6 are susceptible to a resource exhaustion attack, where a maliciously crafted form submission can lead to significant memory allocation issues. This issue stems from the parser's ability to allocate memory resources that can be between three to eight times larger than the upload size, resulting in potential denial of service scenarios. A single upload at high speeds has the potential to exhaust substantial amounts of RAM, potentially crashing the application. The vulnerability is mitigated in Werkzeug version 3.0.6.

References