Monthly
A user-controlled request path that ends in a Windows reserved device name followed by an empty NTFS alternate data stream marker (for example "NUL:") causes Werkzeug's send_from_directory / safe_join helper to open the special device successfully and then block indefinitely, hanging the handling worker. The flaw only manifests on Windows deployments running on NTFS where an application serves attacker-influenced filenames through Werkzeug prior to 3.1.9; Linux and macOS deployments, which are the typical Flask/Werkzeug production case, are unreachable by this condition. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and the assessed impact is limited availability loss rather than data exposure or code execution. Vendor-released patch: 3.1.9.
The CVE-2026-17545 record is effectively empty: it ships with no description, no CVSS vector, no CWE mapping, and no CPE data, and the only intelligence attached to it is that it was reported through the Ubuntu vendor coordination channel. Because the affected package, the vulnerable component, and the required attacker position are all unknown, the risk to any specific Ubuntu deployment cannot be meaningfully assessed from the available data and no impact statement should be issued yet. No public exploit code has been identified at time of analysis, and no EPSS score, KEV listing, or proof-of-concept reference accompanies the record, so there is currently no signal of exploitation activity. The immediate action is intelligence collection rather than mitigation: retrieve the corresponding Ubuntu Security Notice and CVE tracker entry to learn which package and version range are involved before assigning severity or exposure.
Werkzeug versions 3.1.5 and below on Windows fail to properly filter reserved device names in the safe_join function when paths contain multiple segments, allowing attackers to craft requests that trigger indefinite hangs by targeting special device names like NUL. Remote attackers can exploit this denial-of-service vulnerability against applications using send_from_directory to serve user-specified files. A patch is available in version 3.1.6.
Werkzeug versions prior to 3.1.5 fail to properly validate Windows reserved device names in the safe_join function, allowing attackers to bypass path restrictions by using device names with file extensions or trailing spaces (e.g., CON.txt, AUX ). This denial of service vulnerability affects Windows systems running vulnerable Werkzeug versions and could allow an unauthenticated remote attacker to access restricted files or cause application crashes. A patch is available in version 3.1.5 and later.
Werkzeug is a comprehensive WSGI web application library. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Wasmtime is a fast and secure runtime for WebAssembly. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, low attack complexity.
gitoxide is a pure Rust implementation of Git. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A user-controlled request path that ends in a Windows reserved device name followed by an empty NTFS alternate data stream marker (for example "NUL:") causes Werkzeug's send_from_directory / safe_join helper to open the special device successfully and then block indefinitely, hanging the handling worker. The flaw only manifests on Windows deployments running on NTFS where an application serves attacker-influenced filenames through Werkzeug prior to 3.1.9; Linux and macOS deployments, which are the typical Flask/Werkzeug production case, are unreachable by this condition. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and the assessed impact is limited availability loss rather than data exposure or code execution. Vendor-released patch: 3.1.9.
The CVE-2026-17545 record is effectively empty: it ships with no description, no CVSS vector, no CWE mapping, and no CPE data, and the only intelligence attached to it is that it was reported through the Ubuntu vendor coordination channel. Because the affected package, the vulnerable component, and the required attacker position are all unknown, the risk to any specific Ubuntu deployment cannot be meaningfully assessed from the available data and no impact statement should be issued yet. No public exploit code has been identified at time of analysis, and no EPSS score, KEV listing, or proof-of-concept reference accompanies the record, so there is currently no signal of exploitation activity. The immediate action is intelligence collection rather than mitigation: retrieve the corresponding Ubuntu Security Notice and CVE tracker entry to learn which package and version range are involved before assigning severity or exposure.
Werkzeug versions 3.1.5 and below on Windows fail to properly filter reserved device names in the safe_join function when paths contain multiple segments, allowing attackers to craft requests that trigger indefinite hangs by targeting special device names like NUL. Remote attackers can exploit this denial-of-service vulnerability against applications using send_from_directory to serve user-specified files. A patch is available in version 3.1.6.
Werkzeug versions prior to 3.1.5 fail to properly validate Windows reserved device names in the safe_join function, allowing attackers to bypass path restrictions by using device names with file extensions or trailing spaces (e.g., CON.txt, AUX ). This denial of service vulnerability affects Windows systems running vulnerable Werkzeug versions and could allow an unauthenticated remote attacker to access restricted files or cause application crashes. A patch is available in version 3.1.5 and later.
Werkzeug is a comprehensive WSGI web application library. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Wasmtime is a fast and secure runtime for WebAssembly. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, low attack complexity.
gitoxide is a pure Rust implementation of Git. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.