Description
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pgadmin4 | 7.4-1.1 | openSUSE-SU-2024:13098-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-werkzeug | 2.2.2-r0 | — |
| Alpine v3.23 | py3-werkzeug | 2.2.2-r0 | — |
| Alpine v3.22 | py3-werkzeug | 2.2.2-r0 | — |
| Alpine v3.21 | py3-werkzeug | 2.2.2-r0 | — |
| Alpine v3.20 | py3-werkzeug | 2.2.2-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-werkzeug | 2.2.2-r0 | — |
| Alpine v3.18 | py3-werkzeug | 2.2.2-r0 | — |
| Alpine v3.17 | py3-werkzeug | 2.2.2-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
kevin-mizu/Werkzeug-CVE-2022-29361-PoC ★ 5 · Apr 9, 2023
-
l3ragio/CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS ★ 1 · Nov 25, 2023
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | werkzeug | < 2.1.1 | 2.1.1 | PYSEC-2022-203 |
Advisories 4
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- openSUSE-SU-2024:13098-1 pgadmin4-7.4-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2022-1461 IBM Spectrum Protect: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 20, 2023
- WID-SEC-2022-0456 tribe29 checkmk: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Dec 7, 2022