Skip to content
Fencer Vulns
low 2.6

CVE-2023-23934 json

Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

published 2023-02-14 3 y ago modified 2026-09-10 1 mo ago also GHSA-px8h-6qxv-m22q , PYSEC-2023-57 , EUVD-2023-0281

cvss
2.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.

Patch / fix

  • pypi werkzeug 2.2.3
  • palletsprojects werkzeug 2.2.3
  • python-werkzeug Debian 14, Debian 13, Debian 12 2.2.2-3

debian advisories DEBIAN-CVE-2023-23934

  • python-werkzeug Ubuntu 18.04 LTS 0.14.1+dfsg1-1ubuntu0.2
  • python-werkzeug Ubuntu 20.04 LTS 0.16.1+dfsg1-2ubuntu0.1
  • python-werkzeug Ubuntu 22.04 LTS 2.0.2+dfsg1-1ubuntu0.22.04.1
  • python-werkzeug Ubuntu Pro 16.04 LTS 0.10.4+dfsg1-1ubuntu1.2+esm1

ubuntu advisories UBUNTU-CVE-2023-23934

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ceph ceph storage 8.1 2:19.2.1-222.el9cp
  • cephadm ceph storage 8.1 2:19.2.1-222.el9cp
  • liboath ceph storage 8.1, ceph storage 7.1 2.6.12-1.el9cp
  • librbd1 ceph storage 8.1 2:19.2.1-222.el9cp
  • librgw2 ceph storage 8.1 2:19.2.1-222.el9cp
  • rbd-nbd ceph storage 8.1 2:19.2.1-222.el9cp
  • ceph-mib ceph storage 8.1 2:19.2.1-222.el9cp
  • ceph-base ceph storage 8.1 2:19.2.1-222.el9cp

red hat advisories RHSA-2025:9775RHSA-2025:4664RHSA-2023:1018

  • python-werkzeug CBL-Mariner 2.0 2.2.3-1

azure linux advisories AZL-13589

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-23934 updated cvss 2.6

python-werkzeug: cookie prefixed with = can shadow unprefixed cookie

  • Red Hat Enterprise Linux 7 python-werkzeug
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 python3-werkzeug
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4 python-werkzeug, python3-werkzeug
    affected: no fix available
  • Red Hat OpenStack Platform 16.1 python-werkzeug, python3-werkzeug Red Hat OpenStack Platform 16.2 python-werkzeug, python3-werkzeug, python3-designate, openstack-designate-api, openstack-designate-mdns, openstack-designate-sink, +5 more Red Hat Quay 3 quay/quay-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat Storage 3 python-werkzeug Red Hat Update Infrastructure 3 for Cloud Providers python-werkzeug
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 7.1 Tools liboath 2.6.12-1.el8cp, liboath 2.6.12-1.el9cp, oath-toolkit 2.6.12-1.el8cp, oath-toolkit 2.6.12-1.el9cp
    fixed: vendor fix RHSA-2025:4664
  • Red Hat Ceph Storage 8.1 Tools liboath 2.6.12-1.el9cp, oath-toolkit 2.6.12-1.el9cp
    fixed: vendor fix RHSA-2025:9775
  • Red Hat OpenStack Platform 17.0 python-werkzeug 2.0.1-5.el9ost, python3-werkzeug 2.0.1-5.el9ost
    fixed: vendor fix RHSA-2023:1018
show 1 more
  • Red Hat Ceph Storage 7.1 Tools ceph 18.2.1-329.el8cp, ceph 18.2.1-329.el9cp, cephadm 18.2.1-329.el9cp, librbd1 18.2.1-329.el8cp, librbd1 18.2.1-329.el9cp, librgw2 18.2.1-329.el8cp, +37 more Red Hat Ceph Storage 8.1 Tools ceph 19.2.1-222.el9cp, cephadm 19.2.1-222.el9cp, librbd1 19.2.1-222.el9cp, librgw2 19.2.1-222.el9cp, rbd-nbd 19.2.1-222.el9cp, ceph-mib 19.2.1-222.el9cp, +18 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-11 updated cvss 2.6

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 2.6 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD 3.1 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
GitHub 3.1 2.6 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi werkzeug
<2.2.3
2.2.3

Affected products

  • pallets werkzeug

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.