CVE-2024-49767: pallets quart Uncontrolled Resource Consumption
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2024-49767MGASA-2024-0351SUSE-SU-2024:3810-1GHSA-q34m-jh98-gwm2PYSEC-2026-1860PYSEC-2026-3417UBUNTU-CVE-2024-49767USN-7093-1DEBIAN-CVE-2024-49767CGA-22vf-39x2-44j8CGA-23mm-q4m8-372vCGA-2rxg-j3jx-wqrgCGA-2vqj-349j-2xjvCGA-4859-vq5x-hhq4CGA-5pxw-5qp7-j3vjCGA-5x72-fh5v-q897CGA-62wm-mhvr-75jvCGA-6829-63f3-23v9CGA-773x-wqv4-4cr4CGA-7gcv-gmr2-7h4vCGA-7xrp-722f-6rr4CGA-84fw-5ffr-8qrqCGA-8r3c-xjgp-6926CGA-8vvq-48p9-r6qgCGA-fv6x-pv25-qhmjCGA-hcxv-36hw-wp6cCGA-jh5c-p7hp-phm7CGA-m9p5-j9h7-qf24CGA-p2c8-7h3j-2vqwCGA-pjq6-xrrp-hxcjCGA-q4rv-29qf-6365CGA-qh3p-4v25-q5j3CGA-qw34-fc69-42f5CGA-rhcg-5wj9-qmfmCGA-vjp7-47w8-3p45CGA-vjr3-j5g9-f2rvCGA-w92p-mcrm-v8frCGA-wm8c-r582-3c8rCGA-wvqg-7fxm-v48hCGA-x74q-3x52-p4h2CGA-xf6c-p9fw-9m7qCGA-xf77-8vh2-q625CGA-xhh7-j6qr-j3pcCGA-xjx3-f4pp-g85qopenSUSE-SU-2024:14437-1CGA-39hj-fj5q-695xCGA-3h8c-r8q9-gg9mCGA-7j7h-vjj6-h9wwCGA-8x53-5c4w-hg5hCGA-q5hv-j78m-fw68CGA-wm3g-c38h-44mr
Published 25-10-2024Last modified 20-05-2026
Vulnerability summary
CVE-2024-49767 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in pallets quart. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 64.9% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
1.09%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 8Timeline
- 25-10-2024PublishedVulnerability first disclosed.
- 20-05-2026Last modifiedVulnerability information updated.
Description
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
CVSS metrics
11 scores · 8 sources · 2 versionsMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · PypiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.09% on 18-09-2026
18-09-202618-10-2026
EPSS score1.09%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard21 products
- airflowAll versions (No fix recorded)
- airflow-2< 2.11.1-r0
- airflow-2-bitnami-compatAll versions (No fix recorded)
- airflow-3< 3.2.0-r0
- airflow-3-bitnami-compatAll versions (No fix recorded)
Wolfi18 products
- airflowAll versions (No fix recorded)
- airflow-3< 3.2.0-r0
- airflow-3-bitnami-compatAll versions (No fix recorded)
- airflow-bitnami-compatAll versions (No fix recorded)
- emissary< 3.9.1-r4
Opensuse3 products
- python-Werkzeug&distro=openSUSE Leap 15.5< 2.3.6-150400.6.12.1
- python-Werkzeug&distro=openSUSE Leap 15.6< 2.3.6-150400.6.12.1
- python-Werkzeug&distro=openSUSE Tumbleweed< 3.0.6-1.1
Debian2 products
- python-werkzeug< 2.2.2-3+deb12u1 | < 3.1.3-2
- quartAll versions (No fix recorded) | < 0.19.9-1
PyPI2 products
- quart< 0.20.0
- werkzeug≥ 2.0.0rc1, < 3.0.6
Suse2 products
- python-Werkzeug&distro=SUSE Linux Enterprise Module for Python 3 15 SP5< 2.3.6-150400.6.12.1
- python-Werkzeug&distro=SUSE Linux Enterprise Module for Python 3 15 SP6< 2.3.6-150400.6.12.1
Ubuntu2 products
- python-werkzeug< 2.0.2+dfsg1-1ubuntu0.22.04.3 | < 3.0.1-3ubuntu0.2
- quartAll versions (No fix recorded)
Alpine1 product
- py3-werkzeug< 3.0.6-r0
Mageia1 product
- python-werkzeug< 3.0.6-1.mga9
11 vendors · 56 products
References
25 links- github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2X Refsource CONFIRMWEBREPORTAdvisoryVendor Advisory
- github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179bX Refsource MISCWEBFIXPatch
Show all 25 references
- github.com/pallets/werkzeugPACKAGE
- pypi.org/project/quartPACKAGE
- pypi.org/project/werkzeugPACKAGE
- lists.opensuse.org/archives/…Advisory