Read the docs
TI-2023-24778 Aliases CVE-2023-46136GHSA-hrfv-mqp8-q5rw

Uncontrolled resource consumption in pallets werkzeug

Priority LOW 37CWE-400Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400, CWE-787 and the CVSS impact.

Summary

Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1 and 2.3.8.

Why it matters now

EPSS 0.01288 70th percentileScored 2026-11-07
Fix Partial werkzeug (pallets): 3.0.1, 2.3.8Werkzeug (PyPI): 3.0.1, 2.3.8Red Hat: 6 advisoriesRed Hat: 5 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
palletswerkzeug3.0.0 to before 3.0.1; 2.0.0rc1 to before 2.3.83.0.1, 2.3.8Patch availableCNA
—Werkzeug (PyPI)3.0.0 to before 3.0.13.0.1Patch availableGHSA-hrfv-mqp8-q5rw
—Werkzeug (PyPI)2.0.0rc1 to before 2.3.82.3.8Patch availableGHSA-hrfv-mqp8-q5rw
  • werkzeug Vendorpallets Affected 3.0.0 to before 3.0.1; 2.0.0rc1 to before 2.3.8 Fixed in 3.0.1, 2.3.8 Patch available CNA
  • Werkzeug (PyPI) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-hrfv-mqp8-q5rw
  • Werkzeug (PyPI) Vendor— Affected 2.0.0rc1 to before 2.3.8 Fixed in 2.3.8 Patch available GHSA-hrfv-mqp8-q5rw

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*before 2.3.8Vulnerablepallets
cpe:2.3:a:palletsprojects:werkzeug:3.0.0:*:*:*:*:*:*:*3.0.0Vulnerablepallets
  • cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* Versions before 2.3.8 Vulnerable ·pallets
  • cpe:2.3:a:palletsprojects:werkzeug:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·pallets

Remediation

  • Fix · CNA werkzeug (pallets) Fixed in 3.0.1, 2.3.8
  • Fix · GHSA-hrfv-mqp8-q5rw Werkzeug (PyPI) Fixed in 3.0.1 Advisory →
  • Fix · GHSA-hrfv-mqp8-q5rw Werkzeug (PyPI) Fixed in 2.3.8 Advisory →

Red Hat 6 advisories

  • RHSA-2025:9775 Released 2025-06-26 · Red Hat rating Important
    Red Hat Ceph Storage 8.1 security, bug fix, and enhancement updates
    • Red Hat Ceph Storage 8.1 Tools ceph-2:19.2.1-222.el9cp, ceph-base-2:19.2.1-222.el9cp, ceph-common-2:19.2.1-222.el9cp +28
  • RHSA-2024:0189 Released 2024-01-16 · Red Hat rating Moderate
    Red Hat OpenStack Platform 17.1 (python-werkzeug) security update
    • Red Hat OpenStack Platform 17.1 python-werkzeug-2.0.1-8.el8ost, python3-werkzeug-2.0.1-8.el8ost
  • RHSA-2024:0214 Released 2024-01-16 · Red Hat rating Moderate
    Red Hat OpenStack Platform 17.1 (python-werkzeug) security update
    • Red Hat OpenStack Platform 17.1 python-werkzeug-2.0.1-6.el9ost, python3-werkzeug-2.0.1-6.el9ost
Show 3 more Red Hat advisories
  • RHSA-2023:7610 Released 2023-12-06 · Red Hat rating Important
    OpenShift Container Platform 4.12.45 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.12 python-werkzeug-2.0.3-5.el9, python3-werkzeug-2.0.3-5.el9
    • Red Hat OpenShift Container Platform 4.12 bpftool-4.18.0-372.82.1.el8_6, cri-o-1.25.5-2.rhaos4.12.git0217273.el8, kernel-4.18.0-372.82.1.el8_6 +47
  • RHSA-2023:7473 Released 2023-11-29 · Red Hat rating Important
    OpenShift Container Platform 4.14.4 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.14 python-werkzeug-2.2.3-2.el9, python3-werkzeug-2.2.3-2.el9
    • Red Hat OpenShift Container Platform 4.14 haproxy-2.6.13-2.rhaos4.14.el8, haproxy26-2.6.13-2.rhaos4.14.el8
  • RHSA-2023:7477 Released 2023-11-29 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.24 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.13 python-werkzeug-2.0.3-5.el9, python3-werkzeug-2.0.3-5.el9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 16.1AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
Ironic content for Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:7610
Ironic content for Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:7477
Ironic content for Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:7473
Red Hat Ceph Storage 8.1 ToolsFixed RHSA-2025:9775
Red Hat OpenStack Platform 17.1Fixed RHSA-2024:0189, RHSA-2024:0214
Not affected: 7 products
  • Ironic content for Red Hat OpenShift Container Platform 4.13
  • Ironic content for Red Hat OpenShift Container Platform 4.14
  • Red Hat Ceph Storage 8.1 Tools
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46136
  2. 2026-10-03 Alias added: GHSA-hrfv-mqp8-q5rw

References

Patch 1

Advisory 3

Other 6

  • TI-2019-10671 In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. CVSS 3.1HIGH 7.5
  • TI-2022-11856 Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers… CVSS 3.1CRITICAL 9.8
  • TI-2023-10880 Werkzeug may allow high resource usage when parsing multipart form data with many fields CVSS 3.1HIGH 7.5
  • TI-2024-22527 Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution CVSS 3.1HIGH 7.5
  • TI-2024-33234 Werkzeug possible resource exhaustion when parsing file data in forms CVSS 4.0MEDIUM 6.9
  • TI-2019-11011 Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN… CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences