{"id":"CVE-2024-49767","aliases":["ALPINE-CVE-2024-49767","AZL-51690","AZL-51723","BELL-CVE-2024-49767","CLSA-2026-1772410262","CLSA-2026-1772583181","CLSA-2026-1789453348","DEBIAN-CVE-2024-49767","EUVD-2024-3107","GHSA-q34m-jh98-gwm2","MGASA-2024-0351","OESA-2025-1424","OESA-2025-1425","OESA-2025-1426","PYSEC-2026-1860","PYSEC-2026-3417","SUSE-SU-2024:3810-1","UBUNTU-CVE-2024-49767","USN-7093-1","openSUSE-SU-2024:14437-1","openSUSE-SU-2026:11943-1"],"status":"published","title":"Werkzeug possible resource exhaustion when parsing file data in forms","description":"Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01095,"percentile":0.65823,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2024-10-25T19:41:35Z","modified":"2026-11-11T09:38:31Z","fixes":[{"ecosystem":"PyPI","package":"quart","fixed_in":["0.20.0"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"werkzeug","fixed_in":["3.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-werkzeug","fixed_in":["3.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-werkzeug","fixed_in":["3.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-werkzeug","fixed_in":["3.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-werkzeug","fixed_in":["3.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-werkzeug","fixed_in":["3.0.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"python-werkzeug","fixed_in":["2.3.7-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-werkzeug","fixed_in":["3.0.3-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"py3-werkzeug","fixed_in":["2.2.2-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-werkzeug","fixed_in":["3.0.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-werkzeug","fixed_in":["2.2.2-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-werkzeug","fixed_in":["3.1.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-werkzeug","fixed_in":["3.1.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"quart","fixed_in":["0.19.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"quart","fixed_in":["0.19.9-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-werkzeug","fixed_in":["3.0.6-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-werkzeug","fixed_in":["2.0.3-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-werkzeug","fixed_in":["2.0.3-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-werkzeug","fixed_in":["2.2.3-3.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-Werkzeug","fixed_in":["2.3.6-150400.6.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-Werkzeug","fixed_in":["2.3.6-150400.6.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-Werkzeug","fixed_in":["2.3.6-150400.6.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-Werkzeug","fixed_in":["2.3.6-150400.6.12.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-werkzeug","fixed_in":["2.0.2+dfsg1-1ubuntu0.22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-werkzeug","fixed_in":["3.0.1-3ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Werkzeug","fixed_in":["3.0.6-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"quart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0rc1"},{"last_affected":"3.0.5"},{"fixed":"3.0.6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.2-r2"},{"fixed":"2.2.2-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.3-r0"},{"fixed":"3.0.6-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.1"},{"fixed":"1.0.1.post1+tuxcare"}]}],"versions":["1.0.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.3"},{"fixed":"2.2.3.post3+tuxcare"}]}],"versions":["2.2.3","2.2.3.post1+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.8"},{"fixed":"2.3.8.post3+tuxcare"}]}],"versions":["2.3.8","2.3.8.post1+tuxcare","2.3.8.post2+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-3+deb12u1"}]}],"versions":["2.2.2-3"]},{"source":"osv","ecosystem":"Debian:13","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"quart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.3-2","0.19.4-1","0.19.4-2","0.19.5-1","0.19.6-1","0.19.9-1","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-4","0.20.0-5","0.23.1-1","0.23.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"quart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"quart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.9-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0rc1"},{"fixed":"3.0.6"}]}],"versions":["2.0.0","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.0rc5","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.2.0","2.2.0a1","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5"]},{"source":"osv","ecosystem":"PyPI","package":"quart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0"}]}],"versions":["0.1.0","0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.16.1","0.16.2","0.16.3","0.17.0","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.19.1","0.19.2","0.19.3","0.19.4","0.19.5","0.19.6","0.19.7","0.19.8","0.19.9","0.2.0","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.6.0","0.6.1","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.9.0","0.9.1"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-3.oe2403"}]}]},{"source":"osv","ecosystem":"PyPI","package":"quart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0"}]}],"versions":["0.1.0","0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.16.1","0.16.2","0.16.3","0.17.0","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.19.0","0.19.1","0.19.2","0.19.3","0.19.4","0.19.5","0.19.6","0.19.7","0.19.8","0.19.9","0.2.0","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.6.0","0.6.1","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.9.0","0.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0rc1"},{"fixed":"3.0.6"}]}],"versions":["2.0.0","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.0rc5","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.2.0","2.2.0a1","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-150400.6.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-150400.6.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-150400.6.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-150400.6.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2+dfsg1-1ubuntu0.22.04.3"}]}],"versions":["1.0.1+dfsg1-2","2.0.2+dfsg1-1","2.0.2+dfsg1-1ubuntu0.22.04.1","2.0.2+dfsg1-1ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-3ubuntu0.2"}]}],"versions":["2.2.2-3","3.0.1-1","3.0.1-2","3.0.1-3","3.0.1-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"quart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.3-2","0.19.4-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"quart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"quart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.0-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2+dfsg1-1ubuntu0.22.04.3"}]}],"versions":["1.0.1+dfsg1-2","2.0.2+dfsg1-1","2.0.2+dfsg1-1ubuntu0.22.04.1","2.0.2+dfsg1-1ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-3ubuntu0.2"}]}],"versions":["2.2.2-3","3.0.1-1","3.0.1-2","3.0.1-3","3.0.1-3ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.9-1.1"}]}],"bundled":6}],"products":[{"vendor":"pallets","product":"quart"},{"vendor":"pallets","product":"werkzeug"},{"vendor":"palletsprojects","product":"quart"},{"vendor":"palletsprojects","product":"werkzeug"}],"references":[{"url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/pallets/werkzeug/releases/tag/3.0.6","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20250103-0007/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49767","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250103-0007","tags":["web"]},{"url":"https://github.com/pallets/werkzeug/commit/cbb446fdcada7685fce936ded01b76c08dbd6eb5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q34m-jh98-gwm2","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-49767","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-49767","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49767.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-49767","tags":["advisory"]},{"url":"https://github.com/pallets/werkzeug","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0351.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33732","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7093-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1424","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1425","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1426","tags":["advisory"]},{"url":"https://pypi.org/project/quart","tags":["package"]},{"url":"https://pypi.org/project/werkzeug","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243810-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232449","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49767","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-49767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49767","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EEDORZ73SOELOS7TKJQAXXXUI3FKWH3Z/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102598","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-49767","title":"Werkzeug possible resource exhaustion when parsing file data in forms","description":"Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.","status":"published","published":"2024-10-25T19:41:35.029Z","modified":"2026-05-20T22:24:47.608Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:33:56.402064Z"}],"euvd":[{"id":"EUVD-2024-3107","description":"Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.","status":"published","published":"2024-10-25T19:41:35Z","modified":"2026-05-20T22:24:47Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:21:13.845677Z"}],"ghsa":[{"id":"GHSA-q34m-jh98-gwm2","title":"Werkzeug possible resource exhaustion when parsing file data in forms","description":"Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.\n\n\nThe `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.","status":"published","published":"2024-10-25T19:44:43Z","modified":"2026-05-20T22:24:16Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:40:13.628377Z"}],"nvd":[{"id":"CVE-2024-49767","description":"Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.","status":"published","published":"2024-10-25T20:15:04.53Z","modified":"2026-06-17T08:00:24.643Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:10:34.877798Z"}],"osv":[{"id":"ALPINE-CVE-2024-49767","description":"Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.","status":"published","published":"2024-10-25T20:15:04.53Z","modified":"2026-11-03T06:32:50.250404405Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"AZL-51690","title":"CVE-2024-49767 affecting package python-werkzeug for versions less than 2.3.7-3","description":"Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.","status":"published","published":"2024-10-25T20:15:04Z","modified":"2026-04-21T04:33:14.596477Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.3228Z"},{"id":"AZL-51723","title":"CVE-2024-49767 affecting package python-werkzeug for versions less than 3.0.3-2","description":"Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.","status":"published","published":"2024-10-25T20:15:04Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.675084Z"},{"id":"BELL-CVE-2024-49767","status":"published","published":"2024-10-31T10:15:10.579137Z","modified":"2026-08-30T10:43:34.231639Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:20.711507Z"},{"id":"CVE-2024-49767","title":"Werkzeug possible resource exhaustion when parsing file data in forms","description":"Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.","status":"published","published":"2024-10-25T19:41:35.029Z","modified":"2026-10-28T02:30:58.11015007Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"DEBIAN-CVE-2024-49767","description":"Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.","status":"published","published":"2024-10-25T20:15:04.53Z","modified":"2026-11-02T12:03:04.862523112Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"GHSA-q34m-jh98-gwm2","title":"Werkzeug possible resource exhaustion when parsing file data in forms","description":"Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.\n\n\nThe `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.","status":"published","published":"2024-10-25T19:44:43Z","modified":"2026-09-10T03:50:19.984825326Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"OESA-2025-1424","title":"python-werkzeug security update","description":"*werkzeug* German noun: \u0026amp;quot;tool\u0026amp;quot;. Etymology: *werk* (\u0026amp;quot;work\u0026amp;quot;), *zeug* (\u0026amp;quot;stuff\u0026amp;quot;) Werkzeug is a comprehensive `WSGI`_ web application library. It began as a simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility libraries. It includes: -   An interactive debugger that allows inspecting stack traces and     source code in the browser with an interactive interpreter for any     frame in the stack. -   A full-featured request object with objects to interact with     headers, query args, form data, files, and cookies. -   A response object that can wrap other WSGI applications and handle     streaming data. -   A routing system for matching URLs to endpoints and generating URLs     for endpoints, with an extensible system for capturing variables     from URLs. -   HTTP utilities to handle entity tags, cache control, dates, user     agents, cookies, files, and more. -   A threaded WSGI server for use while developing applications     locally. -   A test client for simulating HTTP requests during testing without     requiring running a server. Werkzeug doesn\u0026amp;apos;t enforce any dependencies. It is up to the developer to choose a template engine, database adapter, and even how to handle requests. It can be used to build all sorts of end user applications such as blogs, wikis, or bulletin boards. `Flask`_ wraps Werkzeug, using it to handle the details of WSGI while providing more structure and patterns for defining powerful applications.\r\n\r\nSecurity Fix(es):\n\nWerkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.(CVE-2024-49767)","status":"published","published":"2025-04-18T11:08:31Z","modified":"2026-08-18T01:18:45.826468413Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1425","title":"python-werkzeug security update","description":"*werkzeug* German noun: \u0026amp;quot;tool\u0026amp;quot;. Etymology: *werk* (\u0026amp;quot;work\u0026amp;quot;), *zeug* (\u0026amp;quot;stuff\u0026amp;quot;) Werkzeug is a comprehensive `WSGI`_ web application library. It began as a simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility libraries. It includes: -   An interactive debugger that allows inspecting stack traces and     source code in the browser with an interactive interpreter for any     frame in the stack. -   A full-featured request object with objects to interact with     headers, query args, form data, files, and cookies. -   A response object that can wrap other WSGI applications and handle     streaming data. -   A routing system for matching URLs to endpoints and generating URLs     for endpoints, with an extensible system for capturing variables     from URLs. -   HTTP utilities to handle entity tags, cache control, dates, user     agents, cookies, files, and more. -   A threaded WSGI server for use while developing applications     locally. -   A test client for simulating HTTP requests during testing without     requiring running a server. Werkzeug doesn\u0026amp;apos;t enforce any dependencies. It is up to the developer to choose a template engine, database adapter, and even how to handle requests. It can be used to build all sorts of end user applications such as blogs, wikis, or bulletin boards. `Flask`_ wraps Werkzeug, using it to handle the details of WSGI while providing more structure and patterns for defining powerful applications.\r\n\r\nSecurity Fix(es):\n\nWerkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.(CVE-2024-49767)","status":"published","published":"2025-04-18T11:08:31Z","modified":"2026-08-18T01:18:40.327855503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1426","title":"python-werkzeug security update","description":"*werkzeug* German noun: \u0026amp;quot;tool\u0026amp;quot;. Etymology: *werk* (\u0026amp;quot;work\u0026amp;quot;), *zeug* (\u0026amp;quot;stuff\u0026amp;quot;) Werkzeug is a comprehensive `WSGI`_ web application library. It began as a simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility libraries. It includes: -   An interactive debugger that allows inspecting stack traces and     source code in the browser with an interactive interpreter for any     frame in the stack. -   A full-featured request object with objects to interact with     headers, query args, form data, files, and cookies. -   A response object that can wrap other WSGI applications and handle     streaming data. -   A routing system for matching URLs to endpoints and generating URLs     for endpoints, with an extensible system for capturing variables     from URLs. -   HTTP utilities to handle entity tags, cache control, dates, user     agents, cookies, files, and more. -   A threaded WSGI server for use while developing applications     locally. -   A test client for simulating HTTP requests during testing without     requiring running a server. Werkzeug doesn\u0026amp;apos;t enforce any dependencies. It is up to the developer to choose a template engine, database adapter, and even how to handle requests. It can be used to build all sorts of end user applications such as blogs, wikis, or bulletin boards. `Flask`_ wraps Werkzeug, using it to handle the details of WSGI while providing more structure and patterns for defining powerful applications.\r\n\r\nSecurity Fix(es):\n\nWerkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.(CVE-2024-49767)","status":"published","published":"2025-04-18T11:08:31Z","modified":"2026-08-18T01:18:45.767895503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"PYSEC-2026-1860","title":"Werkzeug possible resource exhaustion when parsing file data in forms","description":"Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.\n\n\nThe `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.","status":"published","published":"2026-07-07T14:34:43.453362Z","modified":"2026-07-13T16:43:34.482065524Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"PYSEC-2026-3417","title":"Werkzeug possible resource exhaustion when parsing file data in forms","description":"Applications using Werkzeug to parse `multipart/form-data` requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the `Request.max_form_memory_size` setting.\n\n\nThe `Request.max_content_length` setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.","status":"published","published":"2026-07-13T14:36:32.817473Z","modified":"2026-07-13T16:43:34.482065524Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"UBUNTU-CVE-2024-49767","description":"Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.","status":"published","published":"2024-10-25T20:15:00Z","modified":"2026-11-11T09:38:31.263039025Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-11T10:00:14.389448Z"},{"id":"CLSA-2026-1772410262","title":"TuxCare security update for werkzeug (3 CVEs)","description":"TuxCare rebuilt werkzeug to address 3 CVEs. Fixed in 1.0.1.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:47:58.794955221Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1772583181","title":"TuxCare security update for werkzeug (2 CVEs)","description":"TuxCare rebuilt werkzeug to address 2 CVEs. Fixed in 2.2.3.post3+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:48:05.106289572Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1789453348","title":"TuxCare security update for werkzeug (4 CVEs)","description":"TuxCare rebuilt werkzeug to address 4 CVEs. Fixed in 2.3.8.post3+tuxcare.","status":"published","published":"2026-09-15T06:22:28Z","modified":"2026-10-15T09:48:01.720371915Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"MGASA-2024-0351","title":"Updated python-werkzeug packages fix security vulnerability","description":"Werkzeug is a Web Server Gateway Interface web application library.\nApplications using `werkzeug.formparser.MultiPartParser` corresponding\nto a version of Werkzeug prior to 3.0.6 to parsing `multipart/form-data`\nrequests (e.g. all flask applications) are vulnerable to a relatively\nsimple but effective resource exhaustion (denial of service) attack. A\nspecifically crafted form submission request can cause the parser to\nallocate and block 3 to 8 times the upload size in main memory. There is\nno upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in\nless than 60 seconds. Werkzeug version 3.0.6 fixes this issue.\n","status":"published","published":"2024-11-09T05:17:41Z","modified":"2026-04-16T04:41:24.136476831Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14437-1","title":"python310-Werkzeug-3.0.6-1.1 on GA media","description":"These are all security issues fixed in the python310-Werkzeug-3.0.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-02-04T04:05:35.033517Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2026:11943-1","title":"python313-Werkzeug-3.1.9-1.1 on GA media","description":"These are all security issues fixed in the python313-Werkzeug-3.1.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-01T00:00:00Z","modified":"2026-10-02T18:23:12.906515335Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2024:3810-1","title":"Security update for python-Werkzeug","description":"This update for python-Werkzeug fixes the following issues:\n\n- CVE-2024-49767: Fixed possible resource exhaustion when parsing file data in forms (bsc#1232449).\n","status":"published","published":"2024-10-30T15:33:52Z","modified":"2026-02-04T02:20:47.410009Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-7093-1","title":"python-werkzeug vulnerability","description":"It was discovered that Werkzeug incorrectly handled multiple form\nsubmission requests. A remote attacker could possibly use this issue to\ncause Werkzeug to consume resources, leading to a denial of service.\n","status":"published","published":"2024-11-05T17:16:10Z","modified":"2026-04-27T17:34:44.525969Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}