CVE-2022-29361: HTTP Request Smuggling in Pallets Werkzeug
Summary
CVE-2022-29361: DISPUTED Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. Affects werkzeug across 2 version ranges.
< 2.1.1
< 9a3a981d70d2e9ec3344b5192f86fcaf3210cd85
Fixed in 9a3a981d70d2e9ec3344b5192f86fcaf3210cd85. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pallets Werkzeug is a Python library that provides a comprehensive set of utilities for building web applications. It is widely used in the Python ecosystem and offers features such as routing, request handling, and response generation. However, versions 2.1.0 and below of Werkzeug are vulnerable to HTTP Request Smuggling attacks.
Vulnerability Detail
The vulnerability in Pallets Werkzeug arises from improper parsing of HTTP requests. Attackers can exploit this issue by sending crafted HTTP requests with multiple requests included inside the body. This can lead to HTTP Request Smuggling, where an attacker can manipulate the HTTP request/response flow, potentially bypassing security measures and gaining unauthorized access to sensitive information. It is important to note that the vendor disputes the severity of this vulnerability, claiming it can only occur in unsupported configurations involving development mode and an external HTTP server.
How To Fix
Latest published version: 3.1.9 as of 22 Oct 2026
pip install --upgrade "werkzeug==3.1.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9a3a981d70d2e9ec3344b5192f86fcaf3210cd85
This is the first release that contains the fix.
pip install --upgrade "werkzeug==9a3a981d70d2e9ec3344b5192f86fcaf3210cd85"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Werkzeug is not feasible, a possible workaround is to ensure that the application is not running in development mode and that it uses an HTTP server provided by the Werkzeug project. This can help mitigate the risk of HTTP Request Smuggling. However, it is still advisable to upgrade to the latest secure version of Werkzeug.
Conclusion
In conclusion, Pallets Werkzeug versions 2.1.0 and below are vulnerable to HTTP Request Smuggling. It is recommended to upgrade to Werkzeug version 2.1.1 or later to fix this vulnerability. If upgrading is not possible, ensure that the application is not running in development mode and uses an HTTP server provided by the Werkzeug project. Stay informed about the latest security updates and apply patches to mitigate potential risks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for werkzeug →
FAQ
HTTP Request Smuggling is a technique where an attacker manipulates the HTTP request/response flow to bypass security measures and gain unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
The vendor disputes the severity of this vulnerability and claims it can only occur in unsupported configurations involving development mode and an external HTTP server. However, it is still recommended to upgrade to the latest secure version of Werkzeug.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is important to stay updated and apply security patches to mitigate potential risks.
You can find more information about this vulnerability in the Pallets Werkzeug advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/werkzeug/PYSEC-2022-203.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for werkzeug.
