Skip to content
Fencer Vulns
high 7.5

CVE-2023-25577 json

Werkzeug may allow high resource usage when parsing multipart form data with many fields

published 2023-02-14 3 y ago modified 2026-09-10 1 mo ago also GHSA-xg9f-g7g7-2323 , PYSEC-2023-58 , EUVD-2023-0282

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.

Patch / fix

  • pypi werkzeug 2.2.3
  • palletsprojects werkzeug 2.2.3
  • python-werkzeug Debian 14, Debian 13, Debian 12 2.2.2-3

debian advisories DEBIAN-CVE-2023-25577

  • python-werkzeug Ubuntu 18.04 LTS 0.14.1+dfsg1-1ubuntu0.2
  • python-werkzeug Ubuntu 20.04 LTS 0.16.1+dfsg1-2ubuntu0.1
  • python-werkzeug Ubuntu 22.04 LTS 2.0.2+dfsg1-1ubuntu0.22.04.1
  • python-werkzeug Ubuntu Pro 16.04 LTS 0.10.4+dfsg1-1ubuntu1.2+esm1

ubuntu advisories UBUNTU-CVE-2023-25577

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ceph ceph storage 8.1 2:19.2.1-222.el9cp
  • cephadm ceph storage 8.1 2:19.2.1-222.el9cp
  • liboath ceph storage 8.1, ceph storage 7.1 2.6.12-1.el9cp
  • librbd1 ceph storage 8.1 2:19.2.1-222.el9cp
  • librgw2 ceph storage 8.1 2:19.2.1-222.el9cp
  • rbd-nbd ceph storage 8.1 2:19.2.1-222.el9cp
  • ceph-mib ceph storage 8.1 2:19.2.1-222.el9cp
  • ceph-base ceph storage 8.1 2:19.2.1-222.el9cp

red hat advisories RHSA-2025:9775RHSA-2025:4664RHSA-2023:1325RHSA-2023:7473RHSA-2023:1018RHSA-2023:1281

  • python-Werkzeug OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 0.12.2-3.6.2
  • openstack-heat OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 9.0.8~dev22-3.30.3
  • venv-openstack-heat OpenStack Cloud 8, HPE Helion OpenStack 8 9.0.8~dev22-12.51.1
  • venv-openstack-magnum OpenStack Cloud 8, HPE Helion OpenStack 8 5.0.2_5.0.2_5.0.2~dev31-11.46.1
  • venv-openstack-sahara OpenStack Cloud 8, HPE Helion OpenStack 8 7.0.5~dev4-11.46.1
  • venv-openstack-octavia OpenStack Cloud 8, HPE Helion OpenStack 8 1.0.6~dev3-12.47.1
  • venv-openstack-designate OpenStack Cloud 8, HPE Helion OpenStack 8 5.0.3~dev7-12.45.1
  • python-Werkzeug OpenStack Cloud Crowbar 9, OpenStack Cloud 9 0.14.1-3.6.2

suse advisories SUSE-SU-2023:2379-1SUSE-SU-2023:2378-1SUSE-SU-2023:1775-1SUSE-SU-2023:1693-1SUSE-SU-2023:1664-1

  • python-Werkzeug openSUSE Tumbleweed 3.1.9-1.1
  • python-Werkzeug openSUSE Tumbleweed 2.2.3-1.1

opensuse advisories openSUSE-SU-2026:11943-1openSUSE-SU-2024:12788-1

  • python-werkzeug CBL-Mariner 2.0 2.0.3-2

azure linux advisories AZL-13588

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-25577 updated cvss 7.5

python-werkzeug: high resource usage when parsing multipart form data with many fields

  • Red Hat Enterprise Linux 7 python-werkzeug Red Hat Enterprise Linux 8 python3-werkzeug Red Hat OpenStack Platform 16.2 python3-designate, openstack-designate-api, openstack-designate-mdns, openstack-designate-sink, openstack-designate-agent, openstack-designate-common, +3 more Red Hat Storage 3 python-werkzeug
    affected: no fix available
  • Red Hat Update Infrastructure 3 for Cloud Providers python-werkzeug
    affected: no fix planned “Out of support scope”
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.11 python-werkzeug 2.0.3-5.el8, python3-werkzeug 2.0.3-5.el8
    fixed: vendor fix RHBA-2023:1759
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.12 python-werkzeug 2.0.3-4.el9, python3-werkzeug 2.0.3-4.el9
    fixed: vendor fix RHBA-2023:1507
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 python-werkzeug 2.0.3-4.el9, python3-werkzeug 2.0.3-4.el9
    fixed: vendor fix RHSA-2023:1325
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.14 python-werkzeug 2.2.3-2.el9, python3-werkzeug 2.2.3-2.el9
    fixed: vendor fix RHSA-2023:7473
  • Red Hat Quay v3 quay/quay-rhel8 v3.10.0-150
    fixed: vendor fix RHSA-2023:7341
  • Red Hat Ceph Storage 7.1 Tools liboath 2.6.12-1.el8cp, liboath 2.6.12-1.el9cp, oath-toolkit 2.6.12-1.el8cp, oath-toolkit 2.6.12-1.el9cp
    fixed: vendor fix RHSA-2025:4664
show 5 more
  • Red Hat Ceph Storage 8.1 Tools liboath 2.6.12-1.el9cp, oath-toolkit 2.6.12-1.el9cp
    fixed: vendor fix RHSA-2025:9775
  • Red Hat OpenShift Container Platform 4.13 python-werkzeug 1.0.1-3.el8ost, python3-werkzeug 1.0.1-3.el8ost
    fixed: vendor fix RHSA-2023:1325
  • Red Hat OpenStack Platform 13.0 - ELS python-werkzeug 0.14.1-3.1.el7ost, python2-werkzeug 0.14.1-3.1.el7ost Red Hat OpenStack Platform 16.1 python-werkzeug 0.14.1-12.el8ost, python3-werkzeug 0.14.1-12.el8ost Red Hat OpenStack Platform 16.2 python-werkzeug 0.14.1-12.el8ost, python3-werkzeug 0.14.1-12.el8ost
    fixed: vendor fix RHSA-2023:1281
  • Red Hat OpenStack Platform 17.0 python-werkzeug 2.0.1-5.el9ost, python3-werkzeug 2.0.1-5.el9ost
    fixed: vendor fix RHSA-2023:1018
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 tox 3.23.0-2.el9.1, crudini 0.9.3-4.el9, pysnmp 4.4.12-6.el9, future 0.18.2-9.el9.1, subunit 1.4.0-6.el9.1, pyflakes 2.2.0-3.el9.1, +463 more Red Hat Ironic content for Red Hat OpenShift Container Platform 4.14 python-eventlet 0.33.1-5.el9, python-markupsafe 2.1.1-4.el9, python3-eventlet 0.33.1-5.el9, python3-markupsafe 2.1.1-4.el9 Red Hat Quay v3 quay/clair-rhel8 v3.10.0-20, quay/quay-builder-rhel8 v3.10.0-17, quay/quay-operator-rhel8 v3.10.0-37, quay/quay-operator-bundle v3.10.0-154, quay/quay-builder-qemu-rhcos-rhel8 v3.10.0-10, quay/quay-container-security-operator-rhel8 v3.10.0-19, +1 more Red Hat Ceph Storage 7.1 Tools ceph 18.2.1-329.el8cp, ceph 18.2.1-329.el9cp, cephadm 18.2.1-329.el9cp, librbd1 18.2.1-329.el8cp, librbd1 18.2.1-329.el9cp, librgw2 18.2.1-329.el8cp, +37 more Red Hat Ceph Storage 8.1 Tools ceph 19.2.1-222.el9cp, cephadm 19.2.1-222.el9cp, librbd1 19.2.1-222.el9cp, librgw2 19.2.1-222.el9cp, rbd-nbd 19.2.1-222.el9cp, ceph-mib 19.2.1-222.el9cp, +18 more Red Hat OpenShift Container Platform 4.11 openshift 4.11.0-202304082115.p0.gceaf338.assembly.stream.el8, openshift-kuryr 4.11.0-202304070715.p0.g93daed6.assembly.stream.el8, openshift-ansible 4.11.0-202304070715.p0.gdf73941.assembly.stream.el8, openshift-clients 4.11.0-202304070715.p0.gdea6f47.assembly.stream.el8, openshift-hyperkube 4.11.0-202304082115.p0.gceaf338.assembly.stream.el8, openshift-kuryr-cni 4.11.0-202304070715.p0.g93daed6.assembly.stream.el8, +6 more
    +3 more products
    Red Hat OpenShift Container Platform 4.12 cri-o 1.25.2-13.rhaos4.12.git3e4b64e.el9, openshift-clients 4.12.0-202303240916.p0.g31aa3e8.assembly.stream.el8, openshift-clients 4.12.0-202303240916.p0.g31aa3e8.assembly.stream.el9, openshift4-aws-iso 4.12.0-202303221729.p0.g6b545b8.assembly.stream.el8, openshift-clients-redistributable 4.12.0-202303240916.p0.g31aa3e8.assembly.stream.el8, openshift-clients-redistributable 4.12.0-202303240916.p0.g31aa3e8.assembly.stream.el9 Red Hat OpenShift Container Platform 4.13 tini 0.16.1-1.el8ar, grpc 1.18.0-4.el8ost, python-rsa 4.7-1.el8, python3-rsa 4.7-1.el8, cri-tools 1.26.0-1.el9, grpc-cli 1.18.0-4.el8ost, +263 more Red Hat OpenShift Container Platform 4.14 haproxy 2.6.13-2.rhaos4.14.el8, haproxy26 2.6.13-2.rhaos4.14.el8, cri-o 1.27.2-2.rhaos4.14.git9d684e2.el8, cri-o 1.27.2-2.rhaos4.14.git9d684e2.el9, openshift 4.14.0-202311161233.p0.gd548052.assembly.stream.el8, openshift 4.14.0-202311161233.p0.gd548052.assembly.stream.el9, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

1.42% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi werkzeug
<2.2.3
2.2.3

Affected products

  • pallets werkzeug

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.