Applications using Werkzeug to parse multipart/form-data
requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max_form_memory_size
setting.
The Request.max_content_length
setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.
{ "nvd_published_at": "2024-10-25T20:15:04Z", "cwe_ids": [ "CWE-400" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-10-25T19:44:43Z" }