GHSA-px8h-6qxv-m22q

    Dashboard / Vulnerabilities / GHSA-px8h-6qxv-m22q

    GHSA-px8h-6qxv-m22q

    Published: 15 Feb 2023Last Modified: 10 Sept 2026

    Summary: Incorrect parsing of nameless cookies leads to __Host- cookies bypass

    Details: Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug <= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.

    References: https://github.com/pallets/werkzeug/security/advisories/GHSA-px8h-6qxv-m22q, https://nvd.nist.gov/vuln/detail/CVE-2023-23934, https://github.com/pallets/werkzeug/commit/cf275f42acad1b5950c50ffe8ef58fe62cdce028, https://github.com/pallets/werkzeug, https://github.com/pallets/werkzeug/releases/tag/2.2.3, https://github.com/pypa/advisory-database/tree/main/vulns/werkzeug/PYSEC-2023-57.yaml, https://security.netapp.com/advisory/ntap-20230818-0003, https://www.debian.org/security/2023/dsa-5470

    Affected packages

    Package

    Name: werkzeug

    Purl: pkg:pypi/werkzeug

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.2.3

    Affected versions

    0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High