Skip to content
OpenAdvisories
Medium USN-7093-1 1 CVE

python-werkzeug vulnerability

Published Nov 5, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Werkzeug incorrectly handled multiple form
submission requests. A remote attacker could possibly use this issue to
cause Werkzeug to consume resources, leading to a denial of service.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS python-werkzeug 2.0.2+dfsg1-1ubuntu0.22.04.3
Ubuntu · 24.04 LTS 24.04:LTS python-werkzeug 3.0.1-3ubuntu0.2

Vulnerabilities 1

  • Medium 6.9
    CVE-2024-49767

    Werkzeug possible resource exhaustion when parsing file data in forms

    Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulner…

    pallets werkzeug Quart airflow-3 Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2024-49767