werkzeug 2.3.5 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the werkzeug package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improper Handling of Windows Device Names Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via the `safe_join` function. An attacker can cause the application to hang indefinitely by requesting a path ending with a Windows special device name, e.g. `CON` or `NUL`. Note: This is only vulnerable on Windows, where special device names are implicitly present in every directory. How to fix Improper Handling of Windows Device Names? Upgrade `werkzeug` to version 3.1.4 or higher.	[,3.1.4)
M Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in `formparser.MultiPartParser()`. An attacker can cause the parser to consume more memory than the upload size, in excess of `max_form_memory_size`, by sending malicious data in a non-file field of a `multipart/form-data` request. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `werkzeug` to version 3.0.6 or higher.	[,3.0.6)
M Directory Traversal Werkzeug is a WSGI web application library. Affected versions of this package are vulnerable to Directory Traversal due to a bypass for `os.path.isabs()`, which allows the improper handling of UNC paths beginning with `/`, in the `safe_join()` function. This allows an attacker to read some files on the affected server, if they are stored in an affected path. Note: This is only exploitable on Windows systems using Python versions prior to 3.11. How to fix Directory Traversal? Upgrade `Werkzeug` to version 3.0.6 or higher.	[,3.0.6)
H Remote Code Execution (RCE) Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient hostname checks and the use of relative paths to resolve requests. When the debugger is enabled, an attacker can convince a user to enter their own PIN to interact with a domain and subdomain they control, and thereby cause malicious code to be executed. The demonstrated attack vector requires a number of conditions that render this attack very difficult to achieve, especially if the victim application is running in the recommended configuration of not having the debugger enabled in production. How to fix Remote Code Execution (RCE)? Upgrade `werkzeug` to version 3.0.3 or higher.	[,3.0.3)
M Inefficient Algorithmic Complexity Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in multipart data parsing. An attacker can cause a denial of service and block worker processes from handling legitimate requests by sending crafted multipart data to an endpoint that will parse it, eventually exhausting or killing all available workers. Exploiting this vulnerability is possible if the uploaded file starts with `CR` or `LF` and is followed by megabytes of data without these characters. How to fix Inefficient Algorithmic Complexity? Upgrade `werkzeug` to version 2.3.8, 3.0.1 or higher.	[,2.3.8)[3.0.0,3.0.1)

Vulnerability

Vulnerable Version

Improper Handling of Windows Device Names

Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via the safe_join function. An attacker can cause the application to hang indefinitely by requesting a path ending with a Windows special device name, e.g. CON or NUL.

Note: This is only vulnerable on Windows, where special device names are implicitly present in every directory.

How to fix Improper Handling of Windows Device Names?

Upgrade werkzeug to version 3.1.4 or higher.

[,3.1.4)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in formparser.MultiPartParser(). An attacker can cause the parser to consume more memory than the upload size, in excess of max_form_memory_size, by sending malicious data in a non-file field of a multipart/form-data request.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade werkzeug to version 3.0.6 or higher.

[,3.0.6)

Directory Traversal

Werkzeug is a WSGI web application library.

Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs(), which allows the improper handling of UNC paths beginning with /, in the safe_join() function. This allows an attacker to read some files on the affected server, if they are stored in an affected path.

Note: This is only exploitable on Windows systems using Python versions prior to 3.11.

How to fix Directory Traversal?

Upgrade Werkzeug to version 3.0.6 or higher.

[,3.0.6)

Remote Code Execution (RCE)

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient hostname checks and the use of relative paths to resolve requests. When the debugger is enabled, an attacker can convince a user to enter their own PIN to interact with a domain and subdomain they control, and thereby cause malicious code to be executed.

The demonstrated attack vector requires a number of conditions that render this attack very difficult to achieve, especially if the victim application is running in the recommended configuration of not having the debugger enabled in production.

How to fix Remote Code Execution (RCE)?

Upgrade werkzeug to version 3.0.3 or higher.

[,3.0.3)

Inefficient Algorithmic Complexity

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in multipart data parsing. An attacker can cause a denial of service and block worker processes from handling legitimate requests by sending crafted multipart data to an endpoint that will parse it, eventually exhausting or killing all available workers.

Exploiting this vulnerability is possible if the uploaded file starts with CR or LF and is followed by megabytes of data without these characters.

How to fix Inefficient Algorithmic Complexity?

Upgrade werkzeug to version 2.3.8, 3.0.1 or higher.

[,2.3.8)[3.0.0,3.0.1)

werkzeug@2.3.5 vulnerabilities

The comprehensive WSGI web application library.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically