# CVE-2023-25577: python3-werkzeug: Werkzeug is a comprehensive WSGI web application library

CVE-2023-25577 is fixed in 3 products on 1 platform, first by python-werkzeug 0.14.1+dfsg1-1ubuntu0.2, released February 14, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-25577
- Priority: High
- CVSS: 7.5 (Medium)
- EPSS: 0.0142
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 14, 2023

## Description

Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | python-werkzeug Debian 12.15 (bookworm) | 2.2.2-3 | [DEBIAN-CVE-2023-25577](https://patchblox.com/security/data/fix/linux/debian-cve-2023-25577.md) | Feb 14, 2023 |
| Linux | python-werkzeug Debian 13.5 (trixie) | 2.2.2-3 | [DEBIAN-CVE-2023-25577](https://patchblox.com/security/data/fix/linux/debian-cve-2023-25577.md) | Feb 14, 2023 |
| Linux | python-werkzeug Debian 14 | 2.2.2-3 | [DEBIAN-CVE-2023-25577](https://patchblox.com/security/data/fix/linux/debian-cve-2023-25577.md) | Feb 14, 2023 |
| Linux | python-werkzeug Ubuntu 18.04.6 LTS (bionic) | 0.14.1+dfsg1-1ubuntu0.2 | [python-werkzeug 0.14.1+dfsg1-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-werkzeug-0.14.1-dfsg1-1ubuntu0.2.md) | Feb 14, 2023 |
| Linux | python3-werkzeug Ubuntu 18.04.6 LTS (bionic) | 0.14.1+dfsg1-1ubuntu0.2 | [python3-werkzeug 0.14.1+dfsg1-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-werkzeug-0.14.1-dfsg1-1ubuntu0.2.md) | Feb 14, 2023 |
| Linux | python3-werkzeug Ubuntu 20.04 LTS (focal) | 0.16.1+dfsg1-2ubuntu0.1 | [python3-werkzeug 0.16.1+dfsg1-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-werkzeug-0.16.1-dfsg1-2ubuntu0.1.md) | Feb 14, 2023 |
| Linux | python3-werkzeug Ubuntu 22.04.1 LTS (jammy) | 2.0.2+dfsg1-1ubuntu0.22.04.1 | [python3-werkzeug 2.0.2+dfsg1-1ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-werkzeug-2.0.2-dfsg1-1ubuntu0.22.04.1.md) | Feb 14, 2023 |
| Linux | python3-werkzeug amzn 2023 | 1.0.1-5.amzn2023.0.3 | [ALAS2023-2023-125](https://patchblox.com/security/data/fix/linux/alas2023-2023-125.md) | Mar 6, 2023 |
| Linux | python3-werkzeug ol 8 | 0:0.12.2-4.0.1.el8 | [ELSA-2023-12709](https://patchblox.com/security/data/fix/linux/elsa-2023-12709.md) | Aug 6, 2023 |
| Linux | python3-werkzeug-doc amzn 2023 | 1.0.1-5.amzn2023.0.3 | [ALAS2023-2023-125](https://patchblox.com/security/data/fix/linux/alas2023-2023-125.md) | Mar 6, 2023 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.