Werkzeug is a WSGI web application library used by many Python web frameworks such as Flask. Versions prior to 3.0.6 that use the MultiPartParser to handle multipart/form-data requests are vulnerable to a resource exhaustion attack. Specifically, a crafted multipart form submission can cause the parser to allocate significantly more memory than the actual upload size, with no upper limit on memory usage. This can result in denial of service by consuming excessive RAM, impacting server availability. The vulnerability is tracked as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The fix is included in Werkzeug 3.0.6.

The vulnerability allows remote attackers to cause denial of service by exhausting server memory resources through crafted multipart/form-data requests. This can degrade or crash affected web applications relying on vulnerable Werkzeug versions, impacting availability. There is no indication of privilege escalation, data disclosure, or code execution. No known exploits in the wild have been reported at this time.

Upgrade to Werkzeug version 3.0.6 or later, where this resource exhaustion vulnerability is fixed. Since no official patch links or advisories are provided in the data, verify the upgrade path through the official Pallets Werkzeug project. Until upgraded, consider implementing request size limits or rate limiting on multipart/form-data uploads to reduce risk. Patch status is not explicitly confirmed in the vendor advisory content provided; check the official vendor advisory for the latest remediation guidance.