Description
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pallets | werkzeug | < 2.2.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-werkzeug | 2.2.2-3 | — |
| Debian 13 | python-werkzeug | 2.2.2-3 | — |
| Debian 12 | python-werkzeug | 2.2.2-3 | — |
| Debian 11 | python-werkzeug | 1.0.1+dfsg1-2+deb11u1 | DSA-5470-1 |
| Debian 10 | python-werkzeug | 0.14.1+dfsg1-4+deb10u2 | DLA-3346-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | python-werkzeug | 2.0.2+dfsg1-1ubuntu0.22.04.1 | USN-5948-1 |
| Ubuntu 20.04 LTS | python-werkzeug | 0.16.1+dfsg1-2ubuntu0.1 | USN-5948-1 |
| Ubuntu 18.04 LTS | python-werkzeug | 0.14.1+dfsg1-1ubuntu0.2 | USN-5948-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | python-werkzeug | 0.10.4+dfsg1-1ubuntu1.2+esm1 | USN-5948-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | python-werkzeug +1 | 2.0.1-5.el9ost | RHSA-2023:1018 |
| Red Hat Ceph Storage 8 | ceph +27 | 2:19.2.1-222.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 8 | cephadm-ansible | 1:4.1.4-1.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 8 | liboath +1 | 2.6.12-1.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 7 | ceph +25 | 2:18.2.1-329.el8cp | RHSA-2025:4664 |
| Red Hat Ceph Storage 7 | cephadm | 2:18.2.1-329.el9cp | RHSA-2025:4664 |
| Red Hat Ceph Storage 7 | liboath +1 | 2.6.12-1.el8cp | RHSA-2025:4664 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-werkzeug +1 | 1.0.1-5.amzn2023.0.4 | ALAS2023-2023-149 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | python-werkzeug | 2.2.3-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | python3-werkzeug | 0.12.2-4.0.1.el8 | ELSA-2023-12709 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.4.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | werkzeug | < 2.2.3 | 2.2.3 | GHSA-px8h-6qxv-m22q |
Advisories 12
- RHSA-2025:4664 Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security, bug fix, and enhancement updates Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:9775 Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security, bug fix, and enhancement updates Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:1018 Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-werkzeug) security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- USN-5948-1 python-werkzeug vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-5470-1 python-werkzeug - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3346-1 python-werkzeug - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-1497 IBM Spectrum Protect: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 23, 2025
- ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300 CISA ICS & IT advisories · Feb 13, 2024
- SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024
- ELSA-2023-12709 Low: python-werkzeug security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 6, 2023
- ALAS2023-2023-149 Moderate: python-werkzeug security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 4, 2023
References
- https://github.com/pallets/werkzeug/security/advisories/GHSA-px8h-6qxv-m22q
- https://github.com/pallets/werkzeug/commit/cf275f42acad1b5950c50ffe8ef58fe62cdce028
- https://github.com/pallets/werkzeug/releases/tag/2.2.3
- https://www.debian.org/security/2023/dsa-5470
- https://security.netapp.com/advisory/ntap-20230818-0003/