{"id":"CVE-2022-29361","aliases":["ALPINE-CVE-2022-29361","BELL-CVE-2022-29361","EUVD-2022-0363","GHSA-7wxw-4483-3m34","PYSEC-2022-203","openSUSE-SU-2024:13098-1"],"status":"disputed","title":"Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to...","description":"Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.08067,"percentile":0.94842,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-444"],"published":"2022-05-24T23:56:15Z","modified":"2026-11-03T07:30:20Z","exploits":[{"source":"pocgithub","id":"kevin-mizu/Werkzeug-CVE-2022-29361-PoC","title":"kevin-mizu/Werkzeug-CVE-2022-29361-PoC","date":"2023-04-09","url":"https://github.com/kevin-mizu/Werkzeug-CVE-2022-29361-PoC"},{"source":"pocgithub","id":"l3ragio/CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS","title":"l3ragio/CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS","date":"2023-11-25","url":"https://github.com/l3ragio/CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS"}],"fixes":[{"ecosystem":"Alpine:v3.17","package":"py3-werkzeug","fixed_in":["2.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-werkzeug","fixed_in":["2.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-werkzeug","fixed_in":["2.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-werkzeug","fixed_in":["2.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-werkzeug","fixed_in":["2.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-werkzeug","fixed_in":["2.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-werkzeug","fixed_in":["2.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-werkzeug","fixed_in":["2.2.2-r0"],"sources":["osv"]},{"ecosystem":"PyPI","package":"werkzeug","fixed_in":["2.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"pgadmin4","fixed_in":["7.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-r0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"werkzeug","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"9a3a981d70d2e9ec3344b5192f86fcaf3210cd85"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}],"versions":["0.1","0.10","0.10.1","0.10.2","0.10.3","0.10.4","0.11","0.11.1","0.11.10","0.11.11","0.11.12","0.11.13","0.11.14","0.11.15","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.11.7","0.11.8","0.11.9","0.12","0.12.1","0.12.2","0.13","0.14","0.14.1","0.15.0","0.15.1","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.16.0","0.16.1","0.2","0.3","0.3.1","0.4","0.4.1","0.5","0.5.1","0.6","0.6.1","0.6.2","0.7","0.7.1","0.7.2","0.8","0.8.1","0.8.2","0.8.3","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","1.0.0","1.0.0rc1","1.0.1","2.0.0","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.0rc5","2.0.1","2.0.2","2.0.3","2.1.0"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-1.1"}]}]}],"products":[{"vendor":"palletsprojects","product":"werkzeug"}],"references":[{"url":"https://github.com/pallets/werkzeug/commit/9a3a981d70d2e9ec3344b5192f86fcaf3210cd85","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/pallets/werkzeug/issues/2420","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29361","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7wxw-4483-3m34"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-29361","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-29361","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29361.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29361","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-29361","description":"Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project","status":"disputed","published":"2022-05-24T23:56:15Z","modified":"2024-08-03T06:17:54.952Z","updated_at":"2026-11-02T14:34:35.945659Z"}],"euvd":[{"id":"EUVD-2022-0363","description":"Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project","status":"published","published":"2022-05-24T23:56:15Z","modified":"2024-08-03T06:17:54Z","updated_at":"2026-11-03T03:25:39.28463Z"}],"ghsa":[{"id":"GHSA-7wxw-4483-3m34","title":"Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to...","description":"Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body.","status":"published","published":"2022-05-26T00:01:31Z","modified":"2023-01-30T05:06:46Z","updated_at":"2026-11-02T14:47:33.82399Z"}],"nvd":[{"id":"CVE-2022-29361","description":"Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project","status":"disputed","published":"2022-05-25T01:15:07.277Z","modified":"2026-06-17T04:40:04.253Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:07:21.261605Z"}],"osv":[{"id":"ALPINE-CVE-2022-29361","description":"Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project","status":"published","published":"2022-05-25T01:15:07.277Z","modified":"2026-11-03T07:30:20.372290468Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"BELL-CVE-2022-29361","title":"CVE-2022-29361 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:54.995994Z","modified":"2026-01-26T09:47:16.589501Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-29361","description":"Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project","status":"published","published":"2022-05-24T23:56:15Z","modified":"2026-10-28T02:30:45.422661068Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"openSUSE-SU-2024:13098-1","title":"pgadmin4-7.4-1.1 on GA media","description":"These are all security issues fixed in the pgadmin4-7.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:14:01.853674Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"PYSEC-2022-203","description":"** DISPUTED ** Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project.","status":"published","published":"2022-05-25T01:15:00Z","modified":"2023-11-08T04:09:13.275498Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}