CVE-2024-49767

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Uncontrolled Resource Consumption pada palletsprojects quart, palletsprojects werkzeug. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.

Rincian

Terbit di NVD

25 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2 advisory vendor
• https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee patch
• https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b patch
• https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f
• https://github.com/pallets/werkzeug/releases/tag/3.0.6 release notes
• https://security.netapp.com/advisory/ntap-20250103-0007/