Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

🗓️ 25 Oct 2023 14:22:59Reported by GitHub Advisory DatabaseType

Werkzeug DoS: High resource usage in multipart/form-data parsin

Reporter	Title	Published	Views	Family All 118
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Pallets Werkzeug denial of service vulnerabilitiy [ CVE-2023-46136]	5 Feb 202419:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Uncontrolled Resource Consumption and Improper Input Validation in Werkzeug (CVE-2023-46136, CVE-2023-25577, CVE-2023-23934)	1 Jul 202518:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Pallets Werkzeug (CVE-2023-46136)	20 Mar 202400:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Cryptography, Werkzeug might affect IBM Storage Sentinel Anomaly Scan Engine (CVE-2023-49083, CVE-2023-46136)	22 Mar 202416:13	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability Werkzeug, Twisted-22.10.0-py3, requests-2.32.2-py3, commons-lang-2.6, commons-fileupload-1.5, urllib3-2.2.2, jetty-server-9.4.56.v20240826 affect IBM Cloud Object Storage Systems (Oct 2025)	24 Oct 202515:45	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	3 May 202410:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Pallets Werkzeug	31 Jan 202421:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Werkzeug affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [ CVE-2023-46136]	27 Feb 202512:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Pallets Werkzeug [CVE-2023-46136]	25 Apr 202418:45	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Werkzeug affects IBM Process Mining CVE-2023-46136	15 Dec 202315:42	–	ibm

Vulners

Node

palletsprojects werkzeugRange2.0.0rc1–2.3.8pip

palletsprojects werkzeugRange3.0.0–3.0.1pip

Source	Link
github	www.github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw
github	www.github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-46136
github	www.github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2
github	www.github.com/pypa/advisory-database/tree/main/vulns/werkzeug/PYSEC-2023-221.yaml
github	www.github.com/pallets/werkzeug/commit/f2300208d5e2a5076cbbb4c2aad71096fd040ef9
security	www.security.netapp.com/advisory/ntap-20231124-0008
github	www.github.com/pallets/werkzeug/commit/cbb446fdcada7685fce936ded01b76c08dbd6eb5
github	www.github.com/advisories/GHSA-hrfv-mqp8-q5rw

20 May 2026 22:16Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5 - 8

EPSS0.00878