Read the docs
TI-2023-10880 Aliases CVE-2023-25577GHSA-xg9f-g7g7-2323

Werkzeug may allow high resource usage when parsing multipart form data with many fields

Priority MEDIUM 42CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0142 72nd percentileScored 2026-11-07
Fix Partial werkzeug (pallets): 2.2.3Werkzeug (PyPI): 2.2.3Red Hat: 7 advisoriesRed Hat: 12 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
palletswerkzeugbefore 2.2.32.2.3Patch availableCNA
—Werkzeug (PyPI)before 2.2.32.2.3Patch availableGHSA-xg9f-g7g7-2323
  • werkzeug Vendorpallets Affected before 2.2.3 Fixed in 2.2.3 Patch available CNA
  • Werkzeug (PyPI) Vendor— Affected before 2.2.3 Fixed in 2.2.3 Patch available GHSA-xg9f-g7g7-2323

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*before 2.2.3Vulnerablepallets
  • cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* Versions before 2.2.3 Vulnerable ·pallets

Remediation

  • Fix · CNA werkzeug (pallets) Fixed in 2.2.3
  • Fix · GHSA-xg9f-g7g7-2323 Werkzeug (PyPI) Fixed in 2.2.3 Advisory →

Red Hat 7 advisories

  • RHSA-2025:9775 Released 2025-06-26 · Red Hat rating Important
    Red Hat Ceph Storage 8.1 security, bug fix, and enhancement updates
    • Red Hat Ceph Storage 8.1 Tools ceph-2:19.2.1-222.el9cp, ceph-base-2:19.2.1-222.el9cp, ceph-common-2:19.2.1-222.el9cp +28
  • RHSA-2025:4664 Released 2025-05-07 · Red Hat rating Important
    Red Hat Ceph Storage 7.1 security, bug fix, and enhancement updates
    • Red Hat Ceph Storage 7.1 Tools ceph-2:18.2.1-329.el8cp, ceph-2:18.2.1-329.el9cp, ceph-base-2:18.2.1-329.el8cp +47
  • RHSA-2023:7341 Released 2023-11-30 · Red Hat rating Important
    Red Hat Quay security update
    • Quay v3 quay/quay-rhel8
Show 4 more Red Hat advisories
  • RHSA-2023:7473 Released 2023-11-29 · Red Hat rating Important
    OpenShift Container Platform 4.14.4 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.14 python-werkzeug-2.2.3-2.el9, python3-werkzeug-2.2.3-2.el9
    • Red Hat OpenShift Container Platform 4.14 haproxy-2.6.13-2.rhaos4.14.el8, haproxy26-2.6.13-2.rhaos4.14.el8
  • RHSA-2023:1325 Released 2023-05-18 · Red Hat rating Important
    OpenShift Container Platform 4.13.0 security update
    • Ironic content for Red Hat OpenShift Container Platform 4.13 python-werkzeug-2.0.3-4.el9, python3-werkzeug-2.0.3-4.el9
    • Red Hat OpenShift Container Platform 4.13 buildah-1:1.29.1-1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.rhaos4.13.el9, cri-o-1.26.3-3.rhaos4.13.git641290e.el9 +27
  • RHSA-2023:1281 Released 2023-03-15 · Red Hat rating Important
    Red Hat OpenStack Platform (python-werkzeug) security update
    • Red Hat OpenStack Platform 13.0 - ELS python-werkzeug-0.14.1-3.1.el7ost, python2-werkzeug-0.14.1-3.1.el7ost, python2-werkzeug-doc-0.14.1-3.1.el7ost
    • Red Hat OpenStack Platform 16.1 python-werkzeug-0.14.1-12.el8ost, python3-werkzeug-0.14.1-12.el8ost
    • Red Hat OpenStack Platform 16.2 python-werkzeug-0.14.1-12.el8ost, python3-werkzeug-0.14.1-12.el8ost
  • RHSA-2023:1018 Released 2023-02-28 · Red Hat rating Important
    Red Hat OpenStack Platform 17.0 (python-werkzeug) security update
    • Red Hat OpenStack Platform 17.0 python-werkzeug-2.0.1-5.el9ost, python3-werkzeug-2.0.1-5.el9ost

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet
Red Hat Update Infrastructure 3 for Cloud ProvidersAffectedNo fix planned: Out of support scope
Ironic content for Red Hat OpenShift Container Platform 4.11Fixed—
Ironic content for Red Hat OpenShift Container Platform 4.12Fixed—
Ironic content for Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:1325
Ironic content for Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:7473
Quay v3Fixed RHSA-2023:7341
Red Hat Ceph Storage 7.1 ToolsFixed RHSA-2025:4664
Red Hat Ceph Storage 8.1 ToolsFixed RHSA-2025:9775
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:1325
Red Hat OpenStack Platform 13.0 - ELSFixed RHSA-2023:1281
Red Hat OpenStack Platform 16.1Fixed RHSA-2023:1281
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:1281
Red Hat OpenStack Platform 17.0Fixed RHSA-2023:1018
Not affected: 9 products
  • Ironic content for Red Hat OpenShift Container Platform 4.13
  • Ironic content for Red Hat OpenShift Container Platform 4.14
  • Quay v3
  • Red Hat Ceph Storage 7.1 Tools
  • Red Hat Ceph Storage 8.1 Tools
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25577
  2. 2026-10-03 Alias added: GHSA-xg9f-g7g7-2323

References

Patch 1

Advisory 2

Other 6

  • TI-2019-10671 In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. CVSS 3.1HIGH 7.5
  • TI-2022-11856 Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers… CVSS 3.1CRITICAL 9.8
  • TI-2024-22527 Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution CVSS 3.1HIGH 7.5
  • TI-2024-33234 Werkzeug possible resource exhaustion when parsing file data in forms CVSS 4.0MEDIUM 6.9
  • TI-2023-24778 Uncontrolled resource consumption in pallets werkzeug CVSS 3.1HIGH 8.0
  • TI-2019-11011 Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN… CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences