Root cause: werkzeug 3.1.0 breaking change (released October 31, 2024)
werkzeug 3.1.0 was released on October 31, 2024 and introduced two new hard limits on form data parsing as potentially breaking changes. GitHub
The two relevant changes:
Request.max_form_memory_sizenow defaults to 500 kB instead of unlimited. Non-file form fields exceeding this size will raise aRequestEntityTooLargeerror. GitHubmax_form_partsstops reading request data if more than 1,000 parts are sent in multipart form data — a protection against a very large number of very small parts. Werkzeug
Both limits were introduced intentionally as DoS protection — not as a bug — which is why they are unlikely to be reverted upstream.
Why it hits Checkmk during Rescan: When rescanning hosts with many services, the browser submits a large multipart POST form to the Checkmk web interface. Depending on the size of the host inventory, this can easily exceed 1,000 form parts and/or 500 kB of non-file field data, triggering HTTP 413 on both counts.
Workaround (as described by @altvater above):
Edit /omd/sites/<site>/lib/python3.12/site-packages/werkzeug/wrappers/request.py and raise the limits:
python
max_form_memory_size = 2_000_000 # 2 MB instead of 500 kB
max_form_parts = 10000 # instead of 1000
Note: This file is part of Checkmk’s bundled Python environment and will be overwritten on every
omd update. The workaround must be re-applied after each Checkmk update.
Sources:
- werkzeug 3.1.0 release notes: Release 3.1.0 · pallets/werkzeug · GitHub
- werkzeug changelog: Changes — Werkzeug Documentation (3.1.x)
- werkzeug request data docs: Dealing with Request Data — Werkzeug Documentation (3.1.x)