CVE-2024-49767: Werkzeug possible resource exhaustion when parsing file data in forms
(updated )
Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max_form_memory_size setting.
The Request.max_content_length setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
References
- github.com/advisories/GHSA-q34m-jh98-gwm2
- github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee
- github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f
- github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b
- github.com/pallets/werkzeug/commit/cbb446fdcada7685fce936ded01b76c08dbd6eb5
- github.com/pallets/werkzeug/releases/tag/3.0.6
- github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2
- nvd.nist.gov/vuln/detail/CVE-2024-49767
- security.netapp.com/advisory/ntap-20250103-0007
Code Behaviors & Features
Detect and mitigate CVE-2024-49767 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →