Skip to content
OpenAdvisories

Package · Wolfi

py3-werkzeug

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.9
    CVE-2024-49767

    Werkzeug possible resource exhaustion when parsing file data in forms

    Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulner…

    pallets werkzeug Quart airflow-3 Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 6.3
    CVE-2024-49766

    Werkzeug safe_join not safe on Windows

    Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially…

    pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Wolfi PyPI