Read the docs
TI-2026-65443 Aliases CVE-2026-102598GHSA-g6x2-hccm-hh4m

Werkzeug safe_join() allows Windows special device names

Priority LOW 34CWE-67Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:. The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0037 31st percentileScored 2026-11-07
Fix Partial werkzeug (pallets): 3.1.9Werkzeug (PyPI): 3.1.9Red Hat: 9 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
palletswerkzeugbefore 3.1.93.1.9Patch availableCNA
—Werkzeug (PyPI)before 3.1.93.1.9Patch availableGHSA-g6x2-hccm-hh4m
  • werkzeug Vendorpallets Affected before 3.1.9 Fixed in 3.1.9 Patch available CNA
  • Werkzeug (PyPI) Vendor— Affected before 3.1.9 Fixed in 3.1.9 Patch available GHSA-g6x2-hccm-hh4m

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*——pallets
  • cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* Versions — — ·pallets

Remediation

  • Fix · CNA werkzeug (pallets) Fixed in 3.1.9
  • Fix · GHSA-g6x2-hccm-hh4m Werkzeug (PyPI) Fixed in 3.1.9 Advisory →

Red Hat 9 advisories

  • RHSA-2026:92452 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:92449 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:90440 Released 2026-10-26 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.6 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
Show 6 more Red Hat advisories
  • RHSA-2026:90432 Released 2026-10-26 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.6 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:83120 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Inference 3.4.6 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:83112 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Inference 3.4.6 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:82415 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cpu)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:82368 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cuda)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:82061 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference Tech Preview 3.5.2 (Gaudi)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat AI Inference Server 3.4Fixed RHSA-2026:83112, RHSA-2026:83120
Red Hat AI Inference Server 3.5Fixed RHSA-2026:82061, RHSA-2026:82368, RHSA-2026:82415
Red Hat Enterprise Linux AI 3.4Fixed RHSA-2026:90432, RHSA-2026:90440
Red Hat Enterprise Linux AI 3.5Fixed RHSA-2026:92449, RHSA-2026:92452
Not affected: 3 products
  • Red Hat Enterprise Linux AI 3.4
  • Red Hat Enterprise Linux AI 3.5
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102598
  2. 2026-10-06 Alias added: GHSA-g6x2-hccm-hh4m
  3. 2026-10-06 Fix available: PyPI/[email protected] · GHSA-g6x2-hccm-hh4m
  4. 2026-10-06 CVSS score added · GHSA-g6x2-hccm-hh4m
  5. 2026-10-06 Weakness changed · GHSA-g6x2-hccm-hh4m
  6. 2026-10-06 6 new references · GHSA-g6x2-hccm-hh4m
  7. 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
  8. 2026-10-13 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
  9. 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
  10. 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
  11. 2026-10-16 Fix available: RHSA-2026:83112 · Red Hat
  12. 2026-10-16 Fix available: RHSA-2026:83120 · Red Hat
  13. 2026-10-16 Fix available: Red Hat AI Inference Server 3.4 · Red Hat
  14. 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
  15. 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
  16. 2026-10-30 Fix available: RHSA-2026:90432 · Red Hat
  17. 2026-10-30 Fix available: RHSA-2026:90440 · Red Hat
  18. 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.4, Red Hat Enterprise Linux AI 3.5 · Red Hat
  19. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

Other 5

  • TI-2026-06360 [DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()" CVSS 3.1HIGH 7.2
  • TI-2019-10671 In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. CVSS 3.1HIGH 7.5
  • TI-2022-11856 Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers… CVSS 3.1CRITICAL 9.8
  • TI-2019-08127 In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape. CVSS 3.1HIGH 8.6
  • TI-2016-08785 In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. CVSS 3.0HIGH 8.6
  • TI-2023-10880 Werkzeug may allow high resource usage when parsing multipart form data with many fields CVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences