7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-49767

CVE-2024-49767: Werkzeug possible resource exhaustion when parsing file data in forms

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max_form_memory_size setting.

The Request.max_content_length setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-49767

CVE-2024-49767:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
werkzeug	pip	<= 3.0.5	3.0.6
Quart	pip	< 0.20.0	0.20.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description states that max_form_memory_size could be bypassed for non-file parts in multipart/form-data requests. I analyzed the provided commit patches for both Werkzeug and Quart.

For Werkzeug (commit 50cfeebcb0727e18cc52ffbeb125f4a66551179b):

The MultiPartParser.parse method in src/werkzeug/formparser.py was modified to introduce field_size tracking. This variable accumulates the size of data for non-file fields (Field instances) across multiple Data events. A check was added to ensure this accumulated field_size does not exceed self.max_form_memory_size. This directly addresses the described vulnerability by ensuring the limit is applied even when field data is chunked.
The MultipartDecoder.receive_data in src/werkzeug/sansio/multipart.py had a minor clarification in its existing size check, but the core logic for accumulating size across events (which was the bypass) was fixed in MultiPartParser.parse.

For Quart (commit 5e78c4169b8eb66b91ead3e62d44721b9e1644ee):

This commit mirrors the Werkzeug fix. The MultiPartParser.parse method in src/quart/formparser.py was updated with similar logic to track field_size for non-file parts and check it against self.max_form_memory_size.

Commit abb04a512496206de279225340ed022852fbf51f for Quart introduces new configuration options and propagates them. While it enhances form parsing security by adding more limits (like max_form_parts), the specific vulnerability of bypassing max_form_memory_size for non-file parts due to chunking was fixed in the parse method of MultiPartParser as detailed in the earlier Quart commit and the Werkzeug commit.

Therefore, the parse methods of MultiPartParser in both Werkzeug and Quart were the functions where the vulnerable logic resided, as they were responsible for processing the form parts and (prior to the patch) failed to correctly enforce max_form_memory_size for chunked non-file field data.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.