CVE-2026-102598: Remote Denial of Service via NTFS Alternate Data Stream Bypass in Werkzeug safe_join

Werkzeug is a comprehensive WSGI web application library for Python, widely utilized as the underlying foundation for frameworks such as Flask. In deployment environments running on Microsoft Windows with an NTFS filesystem, the library exposes a path-traversal and file-handling attack surface through its sanitization utilities. Specifically, the utility function safe_join is designed to ensure that untrusted user-supplied file paths are constrained within a target base directory.\n\nA flaw in the validation logic of safe_join allows attackers to bypass checks designed to restrict access to reserved Windows device names. By appending an empty NTFS Alternate Data Stream (ADS) marker, such as NUL:, an attacker can circumvent the blocklist of legacy DOS device names. This bypass allows the path resolution to succeed, leading to dangerous downstream file-system operations on reserved physical hardware names.\n\nThe primary security consequence of this validation bypass is a remote, unauthenticated Denial of Service (DoS). When a downstream component attempts to open and read from the incorrectly resolved device path, the operating system-level file handler blocks execution indefinitely. This resource exhaustion quickly consumes available server worker threads, rendering the application unavailable to legitimate network traffic.

The root cause of this vulnerability lies in the improper handling of Windows reserved device names, classified under CWE-67. Modern Windows operating systems retain compatibility with legacy MS-DOS device names, including NUL, CON, PRN, AUX, and serial or parallel port identifiers. When applications open these identifiers as file paths, the operating system translates the requests to physical hardware streams or system devices rather than typical storage directories.\n\nTo prevent directory escapes and improper device access, Werkzeug maintains a blocklist of forbidden identifiers inside _windows_device_files and validates path components using safe_join. Prior to version 3.1.9, the validation mechanism checked path segments against this blocklist by partitioning strings around the period (.) character. The logic expected that any file extension or suffix would be isolated, leaving the base name to be evaluated against the restricted device list.\n\nOn NTFS filesystems, files can contain Alternate Data Streams (ADS), defined by a colon (:) separator in the format filename:streamname:streamtype. An empty ADS marker can be appended directly to a device name, resulting in a string such as NUL:. When Werkzeug processed this segment, the partitioning logic looked for a period but found none. Consequently, the string `

Evaluating the vulnerable code path demonstrates how the parser missed the Alternate Data Stream marker. In Werkzeug versions prior to 3.1.9, the check evaluated each directory segment in part.split("/") against the legacy device blocklist using a simple partition. The loop evaluated p.partition(".")[0].strip().upper(), which fails when a colon is present instead of a period.\n\npython\n# Vulnerable implementation in Werkzeug < 3.1.9\nos.name == "nt" and any(\n # Partitions only on period, missing the colon separator\n p.partition(".")[0].strip().upper() in _windows_device_files\n for p in part.split("/")\n)\n\n\nThe patch introduced in version 3.1.9 resolves this validation gap by adding a primary partition step targeting the NTFS stream separator. By partitioning the segment on the colon (:) first, the logic effectively strips any Alternate Data Stream identifiers prior to performing the check against the period (.) character. This ensures that the base device name is isolated and properly validated against the blocklist.\n\npython\n# Patched implementation in Werkzeug 3.1.9\nos.name == "nt" and any(\n # First partitions on colon to strip ADS, then on period\n p.partition(":")[0].partition(".")[0].strip().upper()\n in _windows_device_files\n for p in part.split("/")\n)\n\n\nThis corrective code completely closes this bypass vector by ensuring that strings like NUL: are truncated to NUL before the membership test. This fix is robust against variants using multiple colons or combining colons and periods in unexpected sequences. The modification prevents downstream system calls from interacting with the underlying legacy DOS device drivers under any circumstances.

An attack exploiting CVE-2026-102598 requires specific environmental conditions to trigger successfully. First, the target web application must run on a Windows server utilizing an NTFS filesystem. Second, the application must expose an endpoint that serves static files, downloads, or media resources utilizing Werkzeug's send_from_directory helper or directly invoking safe_join with user-controlled input.\n\nAn unauthenticated attacker begins exploitation by sending a crafted HTTP GET request targeting the file-serving endpoint. The request includes a parameter containing the legacy device name appended with an empty Alternate Data Stream marker, such as ?file=NUL:. Because safe_join fails to flag this string as restricted, it returns the fully resolved path, which is then passed to Python's native open() function.\n\nWhen Windows processes the file-open API call for the resolved path C:\\app\\static\\NUL:, it strips the trailing colon and redirects the operation to the system null device. A read operation on this physical device does not return a typical EOF immediately under these conditions but instead blocks the calling execution thread. Because web application servers rely on a finite pool of worker threads or processes, sequentially submitting these requests quickly exhausts all available threads, resulting in a complete application hang and denial of service.

The security impact of CVE-2026-102598 is classified as a localized Denial of Service (DoS) with a CVSS v4.0 score of 6.3. The vulnerability does not allow for remote code execution, privilege escalation, or unauthorized data disclosure. Confidentiality and integrity remain unaffected because the attacker cannot read files outside the directory or write malicious data to the system.\n\nHowever, the availability impact is significant for applications running on affected Windows systems. Each successful exploit payload blocks a single worker thread permanently. In multi-threaded WSGI containers, sending a small number of concurrent requests matching the pool size will completely freeze the application, preventing legitimate users from accessing the system.\n\nBecause Werkzeug is a foundational package for thousands of web applications, the exposure profile is broad, though mitigated by the requirement for a Windows/NTFS environment. Many production environments run on Linux containers, which are inherently immune to this specific MS-DOS device path behavior. For Windows-based enterprise applications, the risk is elevated because the exploit is exceptionally simple to execute and leaves minimal trace in standard web application logs prior to the thread crash.

The primary remediation path is upgrading the Werkzeug package to version 3.1.9 or later. This upgrade addresses the vulnerability at the library level, ensuring that all dependent frameworks like Flask are protected without requiring application-level code modifications. Administrators should update their dependencies using package managers and redeploy their application containers.\n\nIn environments where immediate upgrading is not possible, system administrators can apply temporary workarounds. One operational mitigation is to implement an application-level input validation filter. This filter should inspect incoming path parameters and explicitly reject any requests containing colons (:) or matching known Windows reserved device names prior to forwarding the input to Werkzeug's file-handling functions.\n\nAdditionally, deploying Web Application Firewall (WAF) rules or configuring reverse proxies (such as IIS or Nginx) to block URI paths containing colons in query parameters or URL segments can prevent exploit payloads from reaching the application server. For long-term resilience, security teams should consider migrating Python-based web applications to Linux-based container environments, which completely eliminates legacy Windows OS-specific path vulnerabilities.