CVE-2026-102598: CWE-67: Improper Handling of Windows Device Names in pallets werkzeug
CVE-2026-102598 is a vulnerability in the Werkzeug WSGI web application library affecting versions prior to 3.1.9. The safe_join function used by send_from_directory improperly handles Windows device names when an empty NTFS Alternate Data Stream (ADS) marker is present. This allows a path ending in a Windows special device name such as NUL: to be opened, causing the file read operation to hang indefinitely. The issue is fixed in version 3.1.9.
AI Analysis
Technical Summary
Werkzeug versions before 3.1.9 contain a vulnerability in the safe_join function, which is used by send_from_directory. The function fails to remove an empty NTFS Alternate Data Stream marker before checking for Windows device names. As a result, an attacker can specify a path ending with a Windows special device name (e.g., NUL:) combined with an empty ADS marker. This causes the special device to open successfully, leading to a file read operation that hangs indefinitely. This improper handling of Windows device names is classified under CWE-67. The vulnerability is resolved in Werkzeug version 3.1.9.
Potential Impact
An attacker can cause the application to hang indefinitely by requesting a path that ends with a Windows special device name combined with an empty NTFS ADS marker. This results in a denial of service condition due to the file read operation hanging. There is no indication of privilege escalation or data disclosure beyond the denial of service.
Mitigation Recommendations
Upgrade Werkzeug to version 3.1.9 or later, where this issue is fixed. No other mitigation is indicated or required.
CVE-2026-102598: CWE-67: Improper Handling of Windows Device Names in pallets werkzeug
Description
CVE-2026-102598 is a vulnerability in the Werkzeug WSGI web application library affecting versions prior to 3.1.9. The safe_join function used by send_from_directory improperly handles Windows device names when an empty NTFS Alternate Data Stream (ADS) marker is present. This allows a path ending in a Windows special device name such as NUL: to be opened, causing the file read operation to hang indefinitely. The issue is fixed in version 3.1.9.
CVSS v4.0
Score 6.3medium
Affected software
pallets
werkzeug
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Werkzeug versions before 3.1.9 contain a vulnerability in the safe_join function, which is used by send_from_directory. The function fails to remove an empty NTFS Alternate Data Stream marker before checking for Windows device names. As a result, an attacker can specify a path ending with a Windows special device name (e.g., NUL:) combined with an empty ADS marker. This causes the special device to open successfully, leading to a file read operation that hangs indefinitely. This improper handling of Windows device names is classified under CWE-67. The vulnerability is resolved in Werkzeug version 3.1.9.
Potential Impact
An attacker can cause the application to hang indefinitely by requesting a path that ends with a Windows special device name combined with an empty NTFS ADS marker. This results in a denial of service condition due to the file read operation hanging. There is no indication of privilege escalation or data disclosure beyond the denial of service.
Mitigation Recommendations
Upgrade Werkzeug to version 3.1.9 or later, where this issue is fixed. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-29T14:18:02.920Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abbda3cf7a7c54106914861
Added to database: 09/29/2026, 15:33:16 UTC
Last enriched: 09/29/2026, 15:47:51 UTC
Last updated: 09/29/2026, 16:36:15 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.