Description
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pallets | werkzeug | < 2.2.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-werkzeug | 2.2.2-3 | — |
| Debian 13 | python-werkzeug | 2.2.2-3 | — |
| Debian 12 | python-werkzeug | 2.2.2-3 | — |
| Debian 11 | python-werkzeug | 1.0.1+dfsg1-2+deb11u1 | DSA-5470-1 |
| Debian 10 | python-werkzeug | 0.14.1+dfsg1-4+deb10u2 | DLA-3346-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | python-werkzeug | 2.0.2+dfsg1-1ubuntu0.22.04.1 | USN-5948-1 |
| Ubuntu 20.04 LTS | python-werkzeug | 0.16.1+dfsg1-2ubuntu0.1 | USN-5948-1 |
| Ubuntu 18.04 LTS | python-werkzeug | 0.14.1+dfsg1-1ubuntu0.2 | USN-5948-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | python-werkzeug | 0.10.4+dfsg1-1ubuntu1.2+esm1 | USN-5948-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openshift Ironic 4 | python-werkzeug +1 | 2.0.3-4.el9 | RHSA-2023:7473, RHSA-2023:1325, RHBA-2023:1759 |
| Red Hat OpenStack 17 | python-werkzeug +1 | 2.0.1-5.el9ost | RHSA-2023:1018 |
| Red Hat OpenStack 16 | python-werkzeug +1 | 0.14.1-12.el8ost | RHSA-2023:1281 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 13 | python-werkzeug +2 | 0.14.1-3.1.el7ost | RHSA-2023:1281 |
| Red Hat OpenShift 4 | buildah +1 | 1:1.29.1-1.rhaos4.13.el9 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | cri-o | 1.26.3-3.rhaos4.13.git641290e.el9 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | haproxy +1 | 2.2.24-3.rhaos4.13.el8 | RHSA-2023:7473, RHSA-2023:1325 |
| Red Hat OpenShift 4 | haproxy26 | 2.6.13-2.rhaos4.14.el8 | RHSA-2023:7473 |
| Red Hat OpenShift 4 | openshift +1 | 4.13.0-202304211155.p0.gb404935.assembly.stream.el8 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | podman +6 | 3:4.4.1-3.rhaos4.13.el8 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | python-werkzeug +1 | 1.0.1-3.el8ost | RHSA-2023:1325 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.10.0-1.rhaos4.13.el9 | RHSA-2023:1325 |
| Red Hat Ceph Storage 8 | ceph +27 | 2:19.2.1-222.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 8 | cephadm-ansible | 1:4.1.4-1.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 8 | liboath +1 | 2.6.12-1.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 7 | ceph +25 | 2:18.2.1-329.el8cp | RHSA-2025:4664 |
| Red Hat Ceph Storage 7 | cephadm | 2:18.2.1-329.el9cp | RHSA-2025:4664 |
| Red Hat Ceph Storage 7 | liboath +1 | 2.6.12-1.el8cp | RHSA-2025:4664 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | python-Werkzeug | 1.0.1-150300.3.3.1 | SUSE-SU-2023:1693-1 |
| SLES 15 SP3 | python-Werkzeug | 1.0.1-150300.3.3.1 | SUSE-SU-2023:1693-1 |
| SLES 15 SP2 | python-Werkzeug | 0.14.1-150100.6.6.1 | SUSE-SU-2023:1664-1 |
| SLES 15 SP1 | python-Werkzeug | 0.14.1-150100.6.6.1 | SUSE-SU-2023:1664-1 |
| SLES 12 | python-Werkzeug | 0.12.2-10.13.1 | SUSE-SU-2023:1775-1 |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | python-Werkzeug | 1.0.1-150300.3.3.1 | SUSE-SU-2023:1693-1 |
| SLES for SAP 15 SP2 | python-Werkzeug | 0.14.1-150100.6.6.1 | SUSE-SU-2023:1664-1 |
| SLES for SAP 15 SP1 | python-Werkzeug | 0.14.1-150100.6.6.1 | SUSE-SU-2023:1664-1 |
| SLE Real Time 15 SP3 | python-Werkzeug | 1.0.1-150300.3.3.1 | SUSE-SU-2023:1693-1 |
| SLE HPC 15 SP3 | python-Werkzeug | 1.0.1-150300.3.3.1 | SUSE-SU-2023:1693-1 |
| SLE HPC 15 SP2 | python-Werkzeug | 0.14.1-150100.6.6.1 | SUSE-SU-2023:1664-1 |
| SLE HPC 15 SP1 | python-Werkzeug | 0.14.1-150100.6.6.1 | SUSE-SU-2023:1664-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat | 11.0.4~dev4-3.24.4 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-swift | 2.19.3~dev3-3.6.3 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Werkzeug | 0.14.1-3.6.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat +1 | 9.0.8~dev22-3.30.3 | SUSE-SU-2023:2379-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-Werkzeug | 0.12.2-3.6.2 | SUSE-SU-2023:2379-1 |
| SUSE OpenStack Cloud 9 | openstack-heat | 11.0.4~dev4-3.24.4 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | openstack-swift | 2.19.3~dev3-3.6.3 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | python-Werkzeug | 0.14.1-3.6.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.41.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.43.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev9-3.42.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.41.3 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.41.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.41.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.3~dev3-2.36.3 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 8 | openstack-heat +1 | 9.0.8~dev22-3.30.3 | SUSE-SU-2023:2379-1 |
| SUSE OpenStack Cloud 8 | python-Werkzeug | 0.12.2-3.6.2 | SUSE-SU-2023:2379-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-designate | 5.0.3~dev7-12.45.1 | SUSE-SU-2023:2379-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.8~dev22-12.51.1 | SUSE-SU-2023:2379-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.46.1 | SUSE-SU-2023:2379-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-octavia | 1.0.6~dev3-12.47.1 | SUSE-SU-2023:2379-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-sahara | 7.0.5~dev4-11.46.1 | SUSE-SU-2023:2379-1 |
| SUSE Manager Server 4.2 | python-Werkzeug | 1.0.1-150300.3.3.1 | SUSE-SU-2023:1693-1 |
| SUSE Manager Proxy 4.2 | python-Werkzeug | 1.0.1-150300.3.3.1 | SUSE-SU-2023:1693-1 |
| SUSE HPE Helion OpenStack 8 | openstack-heat +1 | 9.0.8~dev22-3.30.3 | SUSE-SU-2023:2379-1 |
| SUSE HPE Helion OpenStack 8 | python-Werkzeug | 0.12.2-3.6.2 | SUSE-SU-2023:2379-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-designate | 5.0.3~dev7-12.45.1 | SUSE-SU-2023:2379-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.8~dev22-12.51.1 | SUSE-SU-2023:2379-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.46.1 | SUSE-SU-2023:2379-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-octavia | 1.0.6~dev3-12.47.1 | SUSE-SU-2023:2379-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-sahara | 7.0.5~dev4-11.46.1 | SUSE-SU-2023:2379-1 |
| SUSE Enterprise Storage 7.1 | python-Werkzeug | 1.0.1-150300.3.3.1 | SUSE-SU-2023:1693-1 |
| SUSE Enterprise Storage 7 | python-Werkzeug | 0.14.1-150100.6.6.1 | SUSE-SU-2023:1664-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Werkzeug | 2.2.3-1.1 | openSUSE-SU-2026:11943-1, openSUSE-SU-2024:12788-1 |
| openSUSE Leap 15.4 | python-Werkzeug | 1.0.1-150300.3.3.1 | SUSE-SU-2023:1693-1 |
| openSUSE Leap 15.4 | python-Werkzeug-doc | 0.14.1-150100.6.6.1 | SUSE-SU-2023:1664-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-werkzeug +1 | 1.0.1-5.amzn2023.0.3 | ALAS2023-2023-125 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | python-werkzeug | 2.0.3-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | python3-werkzeug | 0.12.2-4.0.1.el8 | ELSA-2023-12709 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.4.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | werkzeug | < 2.2.3 | 2.2.3 | GHSA-xg9f-g7g7-2323 |
Advisories 24
- RHSA-2023:1325 Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:4664 Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security, bug fix, and enhancement updates Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:9775 Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security, bug fix, and enhancement updates Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2026:11943-1 python313-Werkzeug-3.1.9-1.1 on GA media SUSE / openSUSE Security Updates · Oct 2, 2026
- RHSA-2023:7473 Red Hat Security Advisory: OpenShift Container Platform 4.14.4 packages and security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2023:1281 Red Hat Security Advisory: Red Hat OpenStack Platform (python-werkzeug) security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2023:1018 Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-werkzeug) security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHBA-2023:1759 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.11.37 packages and security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHBA-2023:1507 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.12.10 packages update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- USN-5948-1 python-werkzeug vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-5470-1 python-werkzeug - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3346-1 python-werkzeug - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:2378-1 Security update for openstack-heat, openstack-swift, python-Werkzeug SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1693-1 Security update for python-Werkzeug SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12788-1 python310-Werkzeug-2.2.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2379-1 Security update for openstack-heat, python-Werkzeug SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1775-1 Security update for python-Werkzeug SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1664-1 Security update for python-Werkzeug SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-1497 IBM Spectrum Protect: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 23, 2025
- WID-SEC-2023-0402 xpdf: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 7, 2025
- ELSA-2023-12709 Low: python-werkzeug security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 6, 2023
- WID-SEC-2023-1021 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2023
- ALAS2023-2023-125 Important: python-werkzeug security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 8, 2023
References
- https://github.com/pallets/werkzeug/security/advisories/GHSA-xg9f-g7g7-2323
- https://github.com/pallets/werkzeug/commit/517cac5a804e8c4dc4ed038bb20dacd038e7a9f1
- https://github.com/pallets/werkzeug/releases/tag/2.2.3
- https://www.debian.org/security/2023/dsa-5470
- https://security.netapp.com/advisory/ntap-20230818-0003/