CVE-2022-29361

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-25 · updated 2026-06-17
Weakness: CWE-444

Description

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project

Affected products

pallets werkzeug: through 2.1.0
Pypi Werkzeug: before 2.1.1; 0.1, 0.10, 0.10.1, 0.10.2, 0.10.3, 0.10.4 (+68) — fixed in 2.1.1

How to fix

Upgrade to a fixed version: Pypi Werkzeug 2.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-29361 or the next vulnerability affects your stack