Skip to content
OpenAdvisories

Package · Alpine

py3-werkzeug

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-27199 Public exploit

    Werkzeug safe_join() allows Windows special device names

    Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

    pallets werkzeug open-webui airflow-3 Alpine Wolfi PyPI
  • High 8.0
    CVE-2023-46136 Public exploit

    Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

    Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: a…

    pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Debian Azure Linux Alpine Wolfi PyPI
  • Unscored —
    CVE-2022-29361 Public exploit

    Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggli…

    werkzeug py3-werkzeug Alpine PyPI