/
DirectorySecurity AdvisoriesPricing
Sign in
Security Advisories

CGA-w73w-f2p5-rrxx

Published

Last updated

https://images.chainguard.dev/security/CGA-w73w-f2p5-rrxx
Package

airflow-core-2

Repository

Chainguard

Latest Update
Pending upstream fix
Aliases
  • CVE-2024-49767
  • GHSA-q34m-jh98-gwm2

Severity

Unknown

References

  • https://nvd.nist.gov/vuln/detail/CVE-2024-49767

Updates

Status

Pending upstream fix

Impact

The werkzeug resource exhaustion vulnerability (CVE-2024-49767) requires werkzeug 3.0.6+. However, airflow 2.11.0 requires werkzeug<3,>=2.0, and its dependency Connexion 2.14.2 requires werkzeug<2.3,>=1.0. Upgrading werkzeug to 3.0.6 breaks both airflow and Connexion compatibility. The fix requires upstream airflow to update to support werkzeug 3.x and update or remove the Connexion dependency.

Status

Under investigation

Status

Fixed

Fixed version

2.11.0-r2

Status

Under investigation


The trusted source for open source

Talk to an expert
© 2025 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard ContainersChainguard LibrariesChainguard VMsIntegrationsPricing