Vulnerabilities for Werkzeug

First version without a known vulnerability: 3.1.6

Details

• GHSA-29vq-49wr-vm6x2026-02-19

  Werkzeug safe_join() allows Windows special device names

  Fixed in: 3.1.6

• GHSA-87hc-h4r5-73f72026-01-08

  Werkzeug safe_join() allows Windows special device names with compound extensions

  Fixed in: 3.1.5

• GHSA-hgf8-39gv-g3f22025-12-02

  Werkzeug safe_join() allows Windows special device names

  Fixed in: 3.1.4

• GHSA-q34m-jh98-gwm22024-10-25

  Werkzeug possible resource exhaustion when parsing file data in forms

  Fixed in: 3.0.6, 0.20.0

• GHSA-f9vj-2wh5-fj8j2024-10-25

  Werkzeug safe_join not safe on Windows

  Fixed in: 3.0.6

• GHSA-2g68-c3qc-89852024-05-06

  Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

  Fixed in: 3.0.3

• GHSA-hrfv-mqp8-q5rw2023-10-25

  Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

  Fixed in: 3.0.1, 2.3.8, f3c803b3ade485a45f12b6d6617595350c0f03e2, f2300208d5e2a5076cbbb4c2aad71096fd040ef9

• GHSA-px8h-6qxv-m22q2023-02-15

  Incorrect parsing of nameless cookies leads to __Host- cookies bypass

  Fixed in: 2.2.3, cf275f42acad1b5950c50ffe8ef58fe62cdce028

• GHSA-xg9f-g7g7-23232023-02-15

  High resource usage when parsing multipart form data with many fields

  Fixed in: 2.2.3, 517cac5a804e8c4dc4ed038bb20dacd038e7a9f1

• PYSEC-2022-2032022-05-25

  ** DISPUTED ** Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project.

  Fixed in: 9a3a981d70d2e9ec3344b5192f86fcaf3210cd85, 2.1.1

• GHSA-j544-7q9p-6xp82022-05-24

  Pallets Werkzeug vulnerable to Path Traversal

  Fixed in: 0.15.5

• GHSA-h2fp-xgx6-xh6f2022-05-14

  Pallets Werkzeug cross-site scripting vulnerability

  Fixed in: 0.11.11

• GHSA-3p3h-qghp-hvh22021-04-20

  Open Redirect in werkzeug

  Fixed in: 0.11.6

• GHSA-gq9m-qvpx-68hc2019-08-21

  Pallets Werkzeug Insufficient Entropy

  Fixed in: 0.15.3, 00bc43b1672e662e5e3b8cecd79e67fc968fa246