GHSA-q34m-jh98-gwm2: Werkzeug fixed in 3.0.6

GHSA-q34m-jh98-gwm2 PUBLISHED CVSS 7.5 HIGH

Werkzeug possible resource exhaustion when parsing file data in forms

Record from GitHub Advisory Database · Published October 25, 2024

Werkzeug is fixed in 3.0.6 (PyPI)

Werkzeug possible resource exhaustion when parsing file data in forms

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
Werkzeug	PyPI	3.0.6
Quart	PyPI	0.20.0
superset	Chainguard	4.0.2-r6
kubeflow-pipelines-visualization-server	Wolfi	2.4.0-r0
emissary	Chainguard	3.9.1-r4
kubeflow-volumes-web-app	Wolfi	1.9.2-r1
airflow-3	Wolfi	3.2.0-r0
airflow-core-2	Chainguard	2.11.1-r0
kubeflow-jupyter-web-app	Wolfi	1.9.2-r1
py3-werkzeug	Wolfi	3.0.6-r0
superset	Wolfi	4.0.2-r6
airflow-3	Chainguard	3.2.0-r0

8 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Vendor	Product	Versions
chainguard	superset	0
wolfi	kubeflow-pipelines-visualization-server	0
chainguard	emissary	0
PyPI	Werkzeug	2.0.0rc1
PyPI	Werkzeug	0
wolfi	kubeflow-volumes-web-app	0
wolfi	airflow-3	0
chainguard	airflow-core-2	0
wolfi	kubeflow-jupyter-web-app	0
wolfi	py3-werkzeug	0
PyPI	Quart	0
wolfi	superset	0
chainguard	airflow-3	0
PyPI	quart	0.14.0, 0.16.1, 0.16.2
wolfi	mlflow	0
chainguard	kubeflow-jupyter-web-app	0
chainguard	kubeflow-volumes-web-app	0
chainguard	py3-werkzeug	0
wolfi	emissary	0
chainguard	airflow-2	0

…and 4 more

Timeline

Oct 25, 2024 CVE Published
Mar 2, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-q34m-jh98-gwm2
vulnetix vdb fixes GHSA-q34m-jh98-gwm2

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-q34m-jh98-gwm2/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →