StackRadar

CVE-2024-49767

High

Advisory

Published 25 Oct 2024In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.011
64th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
153
of 17,781 indexed, latest versions
Container images
152
deployed by those charts
Fix available
2 of 2
affected packages

Werkzeug possible resource exhaustion when parsing file data in forms

Carried by container images the latest versions of 153 of 17,781 indexed charts deploy, on 152 images.

Affected packageAffected versionsFixed inImages
werkzeugpypi2.0.0, 2.0.1, 2.0.2, 2.0.3+14 more3.0.6152
quartpypi0.19.40.20.01
OSV records
GHSA-q34m-jh98-gwm2
Also known as
PYSEC-2026-1860, PYSEC-2026-3417

Charts affected

153 by stars
ChartLatestAffected imagesRadar Score
emissary-ingresswenerme8.12.21 of 2See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2024-49767.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
werkzeug@3.0.3
3.0.6

Open the chart page →

10,843
powerdnsadminwitcom-gmbh0.3.41 of 1See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2024-49767.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
werkzeug@2.0.2
3.0.6

Open the chart page →

2,643
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2024-49767.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
werkzeug@3.0.4
3.0.6

Open the chart page →

13,677

Container images carrying it

152 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
pococze/python-hello-elos:2.0.07a1aab425e51
werkzeug@3.0.3
3.0.6
1
prompve/prometheus-pve-exporter:3.4.2fcf041f0c24d
werkzeug@3.0.3
3.0.6
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
werkzeug@2.1.2
3.0.6
1
pysga1996/python-redis-web:latestfdeec30ad482
werkzeug@2.2.3
3.0.6
1
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
werkzeug@2.3.7
3.0.6
1
redash/redash:25.8.000d813437db5
werkzeug@2.3.8
3.0.6
1
redash/redash:26.3.0c5c9148f5c38
werkzeug@2.3.8
3.0.6
1
redislabs/redisinsight:1.14.0b03ab1426d0d
werkzeug@2.2.3
3.0.6
1
reportportal/service-auto-analyzer:5.7.295ada4a216ce
werkzeug@2.1.2
3.0.6
1
reportportal/service-metrics-gatherer:1.1.202a0e6dc11161
werkzeug@2.1.2
3.0.6
1
robotshop/rs-payment:latest774b52c6180d
werkzeug@2.0.1
3.0.6
1
rook/ceph:v1.20.72f970c425617
werkzeug@2.0.3
3.0.6
1
rook/ceph:v1.19.2944a1dd70496
werkzeug@2.0.3
3.0.6
1
sashafefler/spacecapybara_app:latestf96d7804c0ca
werkzeug@2.2.2
3.0.6
1
searx/searx:1.0.0-211-968b28993dbb3a6d9419
werkzeug@2.0.1
3.0.6
1
seldonio/seldon-request-logger:1.11.24e985d2006a8
werkzeug@2.0.2
3.0.6
1
sirrend/helmup-notifications-service:0.1.3997866417011
werkzeug@3.0.3
3.0.6
1
svtechnmaa/svtech_csv:v1.0.1b9d7ecf8de24
werkzeug@2.0.3
3.0.6
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
werkzeug@2.0.3
3.0.6
1
svtechnmaa/svtech_rundeck_option_provider:v1.1.1674fad30a51f
werkzeug@2.0.3
3.0.6
1
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
werkzeug@2.2.3
3.0.6
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
werkzeug@2.2.3
3.0.6
1
taemon1337/image-api:0.0.1247bc1dc4f07
werkzeug@2.0.3
3.0.6
1
teknas09/bird-pod:latest12a1fa85c4aa
werkzeug@3.0.2
3.0.6
1
thecloudspark/app-vote:1.0c7da7417a86a
werkzeug@3.0.3
3.0.6
1
thongngo3301/stakefish:latesta341af5976e3
werkzeug@2.2.3
3.0.6
1
wazuh/wazuh-manager:4.11.11da5c38c6a78
werkzeug@3.0.3
3.0.6
1
wazuh/wazuh-manager:4.4.121994f40e0da
werkzeug@2.2.3
3.0.6
1
yuzutech/kroki-blockdiag:0.16.07c1917c66d96
werkzeug@2.0.2
3.0.6
1
zohardocker12/weather_app_flask:latestb86d60dbb68d
werkzeug@2.0.3
3.0.6
1
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
werkzeug@3.0.2
3.0.6
1
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
werkzeug@3.0.3
3.0.6
1
ghcr.io/blakeblackshear/frigate:0.13.07a5244e4c8dc
werkzeug@3.0.1
3.0.6
1
ghcr.io/blakeblackshear/frigate:0.12.0c862771e38e8
werkzeug@2.2.3
3.0.6
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
werkzeug@2.2.3
3.0.6
1
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
werkzeug@2.2.3
3.0.6
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
werkzeug@2.3.7
3.0.6
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
werkzeug@2.1.2
3.0.6
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
werkzeug@3.0.1
3.0.6
1
ghcr.io/miguelndecarvalho/speedtest-exporter:v3.2.29e36964bce26
werkzeug@2.0.1
3.0.6
1
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
werkzeug@3.0.2
3.0.6
1
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
werkzeug@2.3.6
3.0.6
1
ghcr.io/mshade/kronic:v0.1.466e3043851cd
werkzeug@3.0.1
3.0.6
1
ghcr.io/noahburrell0/sealed-secrets-ui:v0.1.47e7368fb472d
werkzeug@2.2.3
3.0.6
1
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
werkzeug@3.0.1
3.0.6
1
ghcr.io/remla23-team17/app:1.0.05816dbddf47d
werkzeug@2.3.4
3.0.6
1
ghcr.io/remla23-team17/model-service:1.0.0aa59fe2c4f6a
werkzeug@2.3.4
3.0.6
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
werkzeug@3.0.3
3.0.6
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
werkzeug@2.3.7
3.0.6
1
quay.io/maxiv/storageclass-router:0.4.160725dab588c
werkzeug@3.0.1
3.0.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.