Red Hat Security Advisory: RHOSP 17.1.4 (python-werkzeug) security update
Affects Red Hat locustSource GCVE Database
Public exploit available (Metasploit) · fixed in Red Hat package updates : patch Red Hat locust as a priority.
Data as of 26 Oct 2026, 12:54 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 3.3% chance of exploitation in 30 days – higher than 88% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 2.27.0, 3.1.1, 5.0.6_2 +1
Exploitation evidence
Disclosed: evidence found.
CVE published 21 Nov 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: evidence found.
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Homebrewlocustpkg:brew/locustOther threats | Affected
| Fixed in
|
Homebrewmapproxypkg:brew/mapproxyOther threats | Affected
| Fixed in
|
Homebrewmotopkg:brew/motoOther threats | Affected
| Fixed in
|
Homebrewrecon-ngpkg:brew/recon-ngOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
Werkzeug is a WSGI utility module. It includes a debugger, request and response objects, HTTP utilities to handle entity tags, cache control headers, HTTP dates, cookie handling, file uploads, a URL routing system and a numerous community contributed add-on modules. Werkzeug is unicode aware and does not enforce a specific template engine, database adapter or a specific way of handling requests. It is useful for end user applications, such as blogs, wikis, and bulletin boards, that need to operate in a wide variety of server environments. Security Fix(es): * user may execute code on a developer's machine (CVE-2024-34069) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.