CVE-2026-27199: 
Python vulnerability analysis and mitigation

CVE-2026-27199 is a denial-of-service vulnerability in Pallets Werkzeug's safe_join() function that allows Windows special device names (e.g., NUL, CON, PRN) to pass through path validation when preceded by other path segments (e.g., example/NUL). This is a bypass of a previous fix for GHSA-hgf8-39gv-g3f2, which failed to account for multi-segment paths. All Werkzeug versions before 3.1.6 are affected. The vulnerability was disclosed on February 19, 2026, and has a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Werkzeug Advisory).

The root cause is classified as CWE-67 (Improper Handling of Windows Device Names). The prior fix for GHSA-hgf8-39gv-g3f2 checked only the final path component for Windows device names, but safe_join() accepts multiple path segments — meaning a path like example/NUL would pass validation because the check was applied to the full normalized string rather than each individual segment. The send_from_directory() function, which relies on safe_join() to safely serve user-specified files, is the primary attack surface. On Windows, opening a path ending in a device name (e.g., NUL) succeeds at the OS level but causes the read operation to block indefinitely, hanging the worker thread. The fix in commit f407712 iterates over each segment of the path split by / and checks every component against the device name blocklist (GitHub Commit, GitHub Advisory).

Successful exploitation causes worker threads to hang indefinitely, resulting in a denial-of-service condition for the affected web application. The impact is limited to availability — there is no confidentiality or integrity impact, and the vulnerability does not enable code execution or data exfiltration. Only Windows deployments of applications using Werkzeug's send_from_directory() are affected; Linux/macOS deployments are not vulnerable because Windows device name semantics do not apply on those platforms (GitHub Advisory, Werkzeug Advisory).

A public proof-of-concept exploit is available on GitHub at alimezar/CVE-2026-27199-werkzeug-safe-join-bypass-PoC, added to tracking on March 2, 2026. No evidence of active in-the-wild exploitation has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.059% (8th percentile), indicating a low probability of exploitation in the near term. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify web applications running on Windows that use Werkzeug versions before 3.1.6 and expose endpoints backed by send_from_directory() (common in Flask applications serving static or user-specified files).
2. Craft malicious request: Construct an HTTP GET request to the file-serving endpoint with a path that includes a legitimate-looking directory prefix followed by a Windows device name, such as /files/example/NUL or /static/docs/CON.
3. Bypass safe_join validation: Because the prior fix only checked the full normalized path string rather than each segment, the path example/NUL passes the device name filter — safe_join() returns a non-None result and proceeds to open the file.
4. Trigger indefinite hang: The Windows OS opens the device file successfully (e.g., NUL), but the subsequent read operation blocks indefinitely, consuming the worker thread.
5. Repeat for DoS: Send multiple such requests concurrently to exhaust all available worker threads, rendering the application unresponsive to legitimate users (GitHub Advisory, GitHub Commit).

• Network: Repeated HTTP GET requests to file-serving endpoints (e.g., /static/, /files/, /download/) with path components ending in Windows device names such as NUL, CON, PRN, AUX, COM1–COM9, LPT1–LPT9.
• Logs: Web server access logs showing requests with paths like /path/to/NUL, /subdir/CON, or similar multi-segment paths ending in device names; high volume of such requests from a single or small set of source IPs.
• Process/Application: Worker threads or processes in a hung/blocked state with no CPU activity but persistent open handles; application response times degrading or timing out for all requests as thread pool is exhausted.
• File System: No file system artifacts expected, as the attack does not write files — monitoring should focus on process and network indicators.

Upgrade Werkzeug to version 3.1.6 or later, which fixes the multi-segment path bypass by checking each individual path segment against the Windows device name blocklist (Werkzeug Release, GitHub Commit). If immediate patching is not possible, restrict or disable send_from_directory() endpoints, or implement network-level filtering (e.g., WAF rules) to block requests containing Windows device names in URL paths. IBM has also released patches for affected products including IBM Observability with Instana (OnPrem), IBM watsonx Orchestrate with watsonx Assistant Cartridge, and IBM QRadar Suite Software (IBM Instana Advisory, IBM QRadar Advisory).

The vulnerability was reported by researcher alimezar, who also published the proof-of-concept exploit on GitHub. The Werkzeug maintainer davidism published the advisory and patch on February 19, 2026, characterizing the release as a security fix that should not introduce breaking changes. Coverage appeared in security aggregators and newsletters shortly after disclosure, including Secret CISO and InfinitSec, but no major media coverage or significant community controversy has been noted.