{"cve":"CVE-2023-46136","nvd":{"published":"2023-10-25T18:17:36.753","modified":"2026-06-17T06:30:13.700","status":"Modified","description":"Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1 and 2.3.8.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-787","CWE-400","CWE-407"],"references":["https://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2","https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw","https://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2","https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw","https://security.netapp.com/advisory/ntap-20231124-0008/"],"products":["palletsprojects:werkzeug"],"source":"nvd","synced_at":"2026-10-19T21:40:11.519948003+00:00"},"epss":{"cve":"CVE-2023-46136","score":0.01288,"percentile":0.70209,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hrfv-mqp8-q5rw","url":"https://osv.dev/vulnerability/GHSA-hrfv-mqp8-q5rw","summary":"Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning","modified":"2026-09-10T03:50:03.799599710Z","packages":[{"ecosystem":"PyPI","name":"werkzeug","purl":"pkg:pypi/werkzeug","ranges":[">=3.0.0 <3.0.1"],"fixed":["3.0.1"]},{"ecosystem":"PyPI","name":"werkzeug","purl":"pkg:pypi/werkzeug","ranges":[">=2.0.0rc1 <2.3.8"],"fixed":["2.3.8"]}]},{"id":"PYSEC-2023-221","url":"https://osv.dev/vulnerability/PYSEC-2023-221","summary":"","modified":"2023-11-08T18:38:34.170214Z","packages":[{"ecosystem":"PyPI","name":"werkzeug","purl":"pkg:pypi/werkzeug","ranges":["<2.3.8",">=3.0.0 <3.0.1"],"fixed":["2.3.8","3.0.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}