PyPI/werkzeug CVE-2024-49767: high 7.5, EPSS 1.09%

Werkzeug possible resource exhaustion when parsing file data in forms

Action: Upgrade werkzeug to 3.0.6 or later.

pip install werkzeug==3.0.6

Affected

Fixed versions

Sources

• osv: GHSA-q34m-jh98-gwm2
• https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2
• https://nvd.nist.gov/vuln/detail/CVE-2024-49767
• https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee
• https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f
• https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b
• https://github.com/pallets/werkzeug/commit/cbb446fdcada7685fce936ded01b76c08dbd6eb5
• https://github.com/pallets/werkzeug
• https://github.com/pallets/werkzeug/releases/tag/3.0.6
• https://security.netapp.com/advisory/ntap-20250103-0007

CVE-2024-49767 · published 2024-10-25T19:44:43Z · modified 2026-09-10T03:50:19.984825326Z · JSON