CVE-2024-49767

Name of the Vulnerable Software and Affected Versions: Werkzeug versions prior to 3.0.6

Description: Applications using werkzeug.formparser.MultiPartParser to parse multipart/form-data requests are vulnerable to a relatively simple but effective resource exhaustion attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds.

Recommendations: For versions prior to 3.0.6, update to Werkzeug version 3.0.6 to fix the issue. As a temporary workaround, consider setting the Request.max form memory size to limit the resources used during a request. Additionally, consider setting the Request.max content length and resource limits provided by deployment software and platforms to limit the resources used during a request.