[iacobdaniel]

Werkzeug keeps an invalid escape such as %ff as is, while parse_qs turns it into U+FFFD, so attacks in request.args were missed. Keep the parse_qs reading too, for apps that parse the query themselves.

[aikido-pr-checks]

🟡 Medium - Repeated invalid escapes can amplify Quart request memory

A client can send a large query containing repeated escapes such as a=%ff; the ASGI context first stores the parse_qs values and the Quart hook then retains a second framework-decoded list, with set_framework_query appending both readings to context.query. Because this happens before every handler and the repository defines no query-size bound, concurrent requests can use roughly twice the parsed value storage (and the extra parse/copy) to exhaust a worker's memory and availability.

Show fix

Avoid retaining both full value lists for unbounded query input, or enforce a strict query/field budget before parsing and merging. If both representations must be scanned, cap the combined values and discard temporary parser structures as soon as the bounded representation is built.

_{More info - Reply on this comment to give feedback or ignore the issue.}