# CVE-2024-49767: Pallets Werkzeug resource exhaustion in multipart form parsing

Source: https://junglewise.ai/threats/cve-2024-49767-pallets-werkzeug-resource-exhaustion-in-multipart-form-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-25. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2024-49767 · Severity: high · CVSS 7.5 · Published 2024-10-25

Werkzeug is a widely used library for building Python web applications. A vulnerability in how it handles file uploads allows an attacker to send specially crafted requests that bypass memory limits, potentially leading to a denial-of-service by exhausting server resources. This could cause the affected web service to become slow or completely unavailable to legitimate users.

Technologies: [werkzeug (PyPI)](https://junglewise.ai/threats/technologies/werkzeug). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-49767 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-49767 being exploited in the wild.

**How severe is CVE-2024-49767?** High severity, with a CVSS score of 7.5, published 25 October 2024.

**Which products and versions are affected?** Quart (PyPI) < 0.20.0, ECOSYSTEM:introduced=0,fixed=0.20.0; werkzeug (PyPI) >= 2.0.0rc1, <= 3.0.5, ECOSYSTEM:introduced=2.0.0rc1,fixed=3.0.6.

**Is there a fix for CVE-2024-49767?** Yes. Quart (PyPI): upgrade to 0.20.0 or later; werkzeug (PyPI): upgrade to 3.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-49767 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-49767?** Check whether you run Quart (PyPI) or werkzeug (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Quart (PyPI): upgrade to 0.20.0 or later

  ```sh
  pip install "Quart>=0.20.0"
  ```

- werkzeug (PyPI): upgrade to 3.0.6 or later

  ```sh
  pip install "werkzeug>=3.0.6"
  ```


## Technical details

A resource exhaustion vulnerability exists in Werkzeug's multipart/form-data parsing logic. An attacker can bypass the 'Request.max_form_memory_size' security setting by providing a specially crafted form body during a file upload request. This allows for uncontrolled memory consumption, potentially leading to a Denial of Service (DoS) condition. The vulnerability is reachable over the network without authentication or user interaction. While 'max_content_length' remains effective, users are advised to upgrade to Werkzeug 3.0.6 or Quart 0.20.0 to address the bypass.

## Affected products

- Pallets Werkzeug >= 2.0.0rc1, <= 3.0.5
- Pallets Quart < 0.20.0

## Identifiers

- CVE-2024-49767
- GHSA-q34m-jh98-gwm2
- PYSEC-2026-1860
- PYSEC-2026-3417

## Timeline

- 2024-10-25: disclosed
- 2024-10-25: advisory
- 2024-10-25: patched

## References

- [https://api.github.com/users/defnull](https://api.github.com/users/defnull)
- [https://github.com/defnull](https://github.com/defnull)
- [https://api.github.com/users/defnull/gists%7B/gist_id%7D](https://api.github.com/users/defnull/gists%7B/gist_id%7D)
- [https://api.github.com/users/defnull/repos](https://api.github.com/users/defnull/repos)
- [https://avatars.githubusercontent.com/u/62740?v=4](https://avatars.githubusercontent.com/u/62740?v=4)
- [https://api.github.com/users/defnull/events%7B/privacy%7D](https://api.github.com/users/defnull/events%7B/privacy%7D)

## Related threats

- [Quart information disclosure via debug print in request body handling](https://junglewise.ai/threats/quart-leaks-raw-request-body-incl-plaintext-passwords-to-stdout-via-02b677a8)
- [Werkzeug path traversal via NUL device with NTFS ADS marker](https://junglewise.ai/threats/cve-2026-102598-werkzeug-is-a-comprehensive-wsgi-web-application-library-prior)
- [PYSEC-2026-2044 - Werkzeug safe_join() allows Windows special device names with compound extensions](https://junglewise.ai/threats/cve-2026-21860-werkzeug-safe-join-allows-windows-special-device-names-with)
- [PYSEC-2026-2045 - Werkzeug safe_join not safe on Windows](https://junglewise.ai/threats/cve-2024-49766-werkzeug-safe-join-not-safe-on-windows)
- [PYSEC-2026-2043 - Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain](https://junglewise.ai/threats/cve-2024-34069-werkzeug-debugger-remote-code-execution-via-attacker-controlled)