https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:19:39 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-06972 bdu:2025-06972 https://cve.radiocsirt.org/vuln/bdu:2025-06972 https://cve.radiocsirt.org/vuln/bell-cve-2024-49767 <p><strong>Affected:</strong> Alpaquita:23: py3-werkzeug, Alpaquita:stream: py3-werkzeug</p> <p><strong>Affected:</strong> Alpaquita:23: py3-werkzeug, Alpaquita:stream: py3-werkzeug</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-49767 https://cve.radiocsirt.org/vuln/brew-aws-sam-cli-cve-2024-49767 <p><strong>Affected:</strong> Homebrew: aws-sam-cli</p> <p>Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.</p> <p>The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.</p> <p><strong>Affected:</strong> Homebrew: aws-sam-cli</p> <p>Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.</p> <p>The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.</p> https://cve.radiocsirt.org/vuln/brew-aws-sam-cli-cve-2024-49767 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0021 certfr-2025-avi-0021 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0021 https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 https://cve.radiocsirt.org/vuln/euvd-2026-319775 EUVD-2026-319775 https://cve.radiocsirt.org/vuln/euvd-2026-319775 https://cve.radiocsirt.org/vuln/fkie_cve-2024-49767 <p>Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.</p> <p>Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-49767 https://cve.radiocsirt.org/vuln/ghsa-q34m-jh98-gwm2 <p><strong>Affected:</strong> PyPI: Werkzeug, PyPI: Quart</p> <p>Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.</p> <p>The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.</p> <p><strong>Affected:</strong> PyPI: Werkzeug, PyPI: Quart</p> <p>Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.</p> <p>The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.</p> https://cve.radiocsirt.org/vuln/ghsa-q34m-jh98-gwm2 https://cve.radiocsirt.org/vuln/msrc_cve-2024-49767 msrc_CVE-2024-49767 https://cve.radiocsirt.org/vuln/msrc_cve-2024-49767 https://cve.radiocsirt.org/vuln/oesa-2025-1424 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: python-werkzeug</p> <p>*werkzeug* German noun: &amp;amp;quot;tool&amp;amp;quot;. Etymology: *werk* (&amp;amp;quot;work&amp;amp;quot;), *zeug* (&amp;amp;quot;stuff&amp;amp;quot;) Werkzeug is a comprehensive `WSGI`_ web application library. It began as a simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility libraries. It includes: - An interactive debugger that allows inspecting stack traces and source code in the browser with an interactive interpreter for any frame in the stack. - A full-featured request object with objects to interact with headers, query args, form data, files, and cookies. - A response object that can wrap other WSGI applications and handle streaming data. - A routing system for matching URLs to endpoints and generating URLs for endpoints, with an extensible system for capturing variables from URLs. - HTTP utilities to handle entity tags, cache control, dates, user agents, cookies, files, and more. - A threaded WSGI server for use while developing applications locally. - A test client for simulating HTTP requests during testing without requiring running a server. Werkzeug doesn&amp;amp;apos;t enforce any dependencies. It is up to the developer to choose a template engine, database adapter, and even how to handle requests. It can be used to build all sorts of end user applications such as blogs, wikis, or bulletin boards. `Flask`_ wraps Werkzeug, using it to handle the details of WSGI while providin…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: python-werkzeug</p> <p>*werkzeug* German noun: &amp;amp;quot;tool&amp;amp;quot;. Etymology: *werk* (&amp;amp;quot;work&amp;amp;quot;), *zeug* (&amp;amp;quot;stuff&amp;amp;quot;) Werkzeug is a comprehensive `WSGI`_ web application library. It began as a simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility libraries. It includes: - An interactive debugger that allows inspecting stack traces and source code in the browser with an interactive interpreter for any frame in the stack. - A full-featured request object with objects to interact with headers, query args, form data, files, and cookies. - A response object that can wrap other WSGI applications and handle streaming data. - A routing system for matching URLs to endpoints and generating URLs for endpoints, with an extensible system for capturing variables from URLs. - HTTP utilities to handle entity tags, cache control, dates, user agents, cookies, files, and more. - A threaded WSGI server for use while developing applications locally. - A test client for simulating HTTP requests during testing without requiring running a server. Werkzeug doesn&amp;amp;apos;t enforce any dependencies. It is up to the developer to choose a template engine, database adapter, and even how to handle requests. It can be used to build all sorts of end user applications such as blogs, wikis, or bulletin boards. `Flask`_ wraps Werkzeug, using it to handle the details of WSGI while providin…</p> https://cve.radiocsirt.org/vuln/oesa-2025-1424 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14437-1 <p>python310-Werkzeug-3.0.6-1.1 on GA media</p> <p>python310-Werkzeug-3.0.6-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14437-1 https://cve.radiocsirt.org/vuln/pysec-2026-1860 <p><strong>Affected:</strong> PyPI: quart</p> <p>Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.</p> <p>The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.</p> <p><strong>Affected:</strong> PyPI: quart</p> <p>Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.</p> <p>The `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1860 https://cve.radiocsirt.org/vuln/rhsa-2024:10852 <p>freeradius: forgery attack pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms</p> <p>freeradius: forgery attack pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms</p> https://cve.radiocsirt.org/vuln/rhsa-2024:10852 https://cve.radiocsirt.org/vuln/suse-su-2024:3810-1 <p>Security update for python-Werkzeug</p> <p>Security update for python-Werkzeug</p> https://cve.radiocsirt.org/vuln/suse-su-2024:3810-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-49767 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: python-werkzeug, Ubuntu:22.04:LTS: quart, Ubuntu:24.04:LTS: python-werkzeug, Ubuntu:24.04:LTS: quart, Ubuntu:25.10: quart, Ubuntu:26.04:LTS: quart</p> <p>Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: python-werkzeug, Ubuntu:22.04:LTS: quart, Ubuntu:24.04:LTS: python-werkzeug, Ubuntu:24.04:LTS: quart, Ubuntu:25.10: quart, Ubuntu:26.04:LTS: quart</p> <p>Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-49767 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3614 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3614