VDB
ALPINE-CVE-2022-29361
ALPINE-CVE-2022-29361
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.24 | py3-werkzeug | 0 |
| Alpine:v3.23 | py3-werkzeug | 0.11.15-r0, 0.14.1-r1, 0.14.1-r2 |
Timeline
- May 25, 2022 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated