Allocation of Resources Without Limits or Throttling Affecting werkzeug package, versions [,3.0.6)
Threat Intelligence
EPSS
0.06% (25th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-WERKZEUG-8309092
- published 27 Oct 2024
- disclosed 25 Oct 2024
- credit Marcel Hellkamp
Introduced: 25 Oct 2024
New CVE-2024-49767 Open this link in a new tabHow to fix?
Upgrade werkzeug to version 3.0.6 or higher.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in formparser.MultiPartParser(). An attacker can cause the parser to consume more memory than the upload size, in excess of max_form_memory_size, by sending malicious data in a non-file field of a multipart/form-data request.