[GHSA-q34m-jh98-gwm2] Werkzeug possible resource exhaustion when parsing file data in forms

[levpachmanov]

Updates

• Affected products
• CVSS v3

Comments
I verified that version 1.0.1 isn't affected by adding the following test:

    def test_multipart_max_form_memory_size(self) -> None:
        """max_form_memory_size is tracked across multiple data events."""
        data = b"--bound\r\nContent-Disposition: form-field; name=a\r\n\r\n"
        data += b"a" * 4096 + b"\r\n--bound--"
        # The buffer size is less than the max size, so multiple data events will be
        # returned. The field size is greater than the max.
        parser = formparser.MultiPartParser(max_form_memory_size=2048, buffer_size=1024)

        with pytest.raises(RequestEntityTooLarge):
            parser.parse(io.BytesIO(data), b"bound", None)

[github]

Hi there @davidism! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory