CVE-2023-46136: Denial of Service Vulnerability in Werkzeug
Summary
CVE-2023-46136: Werkzeug is a comprehensive WSGI web application library. Affects werkzeug across 4 version ranges.
< 2.3.8
>= 3.0.0, < 3.0.1
< f3c803b3ade485a45f12b6d6617595350c0f03e2
< f2300208d5e2a5076cbbb4c2aad71096fd040ef9
Fixed in 2.3.8 or 3.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- python-werkzeug · Debian:12
The same CVE-2023-46136 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Werkzeug is a comprehensive WSGI web application library used for developing web applications in Python. It provides various utilities and features to handle HTTP requests and responses. Werkzeug is widely used in the Python ecosystem and is available on PyPI (Python Package Index).
Vulnerability Detail
The vulnerability (CVE-2023-46136) in Werkzeug allows an attacker to cause a denial of service (DoS) by sending crafted multipart data to an endpoint that will parse it. Specifically, if an upload of a file starts with a carriage return (CR) or line feed (LF) character and is followed by megabytes of data without these characters, all of these bytes are appended chunk by chunk into an internal bytearray. The lookup for the boundary is performed on the growing buffer, which can consume a significant amount of CPU time. This can lead to worker processes being blocked from handling legitimate requests, resulting in a DoS condition. The vulnerability has a CVSS score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How To Fix
Latest published version: 3.1.9 as of 22 Oct 2026
pip install --upgrade "werkzeug==3.1.9"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.3.82.3.8pip install --upgrade "werkzeug==2.3.8" -
>= 3.0.0, < 3.0.13.0.1pip install --upgrade "werkzeug==3.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The vulnerability in Werkzeug allows an attacker to cause a denial of service by sending specially crafted multipart data. It is recommended to upgrade to Werkzeug version 3.0.1 or later to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for werkzeug →
FAQ
The vulnerability allows an attacker to cause a denial of service by sending specially crafted multipart data. This can result in worker processes being blocked from handling legitimate requests, leading to a DoS condition.
No, authentication is not required to exploit this vulnerability. An attacker can send the malicious multipart data to the affected endpoint without any authentication.
No, only versions prior to 3.0.1 are affected by this vulnerability. Users are advised to upgrade to version 3.0.1 or later to mitigate the risk.
No, there is no known workaround available for this vulnerability. It is recommended to upgrade to the patched version of Werkzeug.
You can find more information about this vulnerability in the Werkzeug advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/werkzeug/PYSEC-2023-221.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for werkzeug.
