Executive brief
Werkzeug is a widely used library for building web applications in Python. A flaw in how it handles file uploads allows an attacker to send a specially crafted request that consumes excessive CPU and memory. This can slow down or completely crash the web server, preventing legitimate users from accessing the service.
Technical details
A denial of service vulnerability exists in the Werkzeug multipart/form-data parser due to inefficient buffer management. When a multipart part begins with a carriage return (CR) or line feed (LF) character followed by a large amount of data without those characters, the parser inefficiently appends chunks to an internal bytearray. This results in quadratic-time complexity for boundary lookups on a growing buffer. An attacker can exploit this by sending crafted multipart data to any endpoint that parses such input, leading to high CPU usage and potential Out-of-Memory (OOM) kills. The issue is fixed in versions 3.0.1 and 2.3.8.
Affected products
- Pallets Werkzeug >= 3.0.0, < 3.0.1; >= 2.0.0rc1, < 2.3.8
Timeline
- 2023-10-24: patched: Fixes released in versions 3.0.1 and 2.3.8
- 2023-10-25: disclosed: GitHub Advisory published