CVE-2022-29361

python-Werkzeug: HTTP Request Smuggling

Loading…

Severity

Unknown

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · May 25, 2022

Updated · November 21, 2025

Description

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project

Statement

Red Hat Product Security does not consider this to be a vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')