CVE-2024-49767

CVE-2024-49767 is a resource exhaustion vulnerability affecting applications using Werkzeug versions prior to 3.0.6, including Flask applications, when parsing multipart/form-data requests. A specially crafted request can cause the parser to allocate significantly more memory than the upload size, leading to a denial of service. This vulnerability has a CVSS score of 7.5 (High) due to its network-based attack vector and low complexity, allowing an unauthenticated attacker to exhaust system resources. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.