要点
- CVE-2024-49767 是影响 quart, werkzeug, quart (palletsprojects) 的高危 (CVSS 7.5)漏洞。
- 未来 30 天内被利用的概率（EPSS）：1.1%，高于 65.6% 的漏洞。
- 修复：升级到 0.20.0, 3.0.6, 0.19.7 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| quart PyPI | < 0.20.0
| 0.20.0
|
| werkzeug PyPI | ≥ 2.0.0rc1, < 3.0.6
| 3.0.6
|
| quart | < 0.19.7
| 0.19.7
|
| werkzeug | < 3.0.6
| 3.0.6
|
Description
Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max_form_memory_size setting.
The Request.max_content_length setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
NVD description
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free