7.5
HIGH
CVE-2024-49767
Flask Werkzeug Multipart Form Data Denial of Service Vulnerability
Description

Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.

INFO

Published Date :

Oct. 25, 2024, 8:15 p.m.

Last Modified :

Jan. 3, 2025, 12:15 p.m.

Remotely Exploitable :

Yes !

Impact Score :

3.6

Exploitability Score :

3.9
Public PoC/Exploit Available at Github

CVE-2024-49767 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-49767 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Palletsprojects werkzeug
2 Palletsprojects quart

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Offline CVE scanner for project dependencies.

Python

Updated: 2 months ago
0 stars 0 fork 0 watcher
Born at : May 9, 2025, 4:11 a.m. This repo has been linked 6 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-49767 vulnerability anywhere in the article.

  • Cyber Security News
Splunk Address Third-Party Packages Vulnerabilities in SOAR Versions – Update Now

Splunk has released critical security updates addressing multiple vulnerabilities in third-party packages in SOAR versions 6.4.0 and 6.4. Published on July 7, 2025, this comprehensive security update ... Read more

Published Date: Jul 09, 2025 (2 weeks, 3 days ago)

The following table lists the changes that have been made to the CVE-2024-49767 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Jan. 03, 2025

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20250103-0007/
  • CVE Modified by [email protected]

    Dec. 27, 2024

    Action Type Old Value New Value
    Added Reference https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f
  • Initial Analysis by [email protected]

    Nov. 05, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    Changed Reference Type https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee No Types Assigned https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee Patch
    Changed Reference Type https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b No Types Assigned https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b Patch
    Changed Reference Type https://github.com/pallets/werkzeug/releases/tag/3.0.6 No Types Assigned https://github.com/pallets/werkzeug/releases/tag/3.0.6 Release Notes
    Changed Reference Type https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2 No Types Assigned https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2 Vendor Advisory
    Added CPE Configuration OR *cpe:2.3:a:palletsprojects:quart:*:*:*:*:*:python:*:* versions up to (excluding) 0.19.7 *cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.6
  • CVE Received by [email protected]

    Oct. 25, 2024

    Action Type Old Value New Value
    Added Description Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
    Added Reference GitHub, Inc. https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2 [No types assigned]
    Added Reference GitHub, Inc. https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee [No types assigned]
    Added Reference GitHub, Inc. https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b [No types assigned]
    Added Reference GitHub, Inc. https://github.com/pallets/werkzeug/releases/tag/3.0.6 [No types assigned]
    Added CWE GitHub, Inc. CWE-770
    Added CWE GitHub, Inc. CWE-400
    Added CVSS V4.0 GitHub, Inc. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-49767 is associated with the following CWEs:

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability