Werkzeug vulnerabilities

The Werkzeug library has a vulnerability that allows for a remote denial of service attack by sending specially crafted multipart data. This affects versions 3.x prior to 3.0.1 and 2.x prior to 2.3.8.

In Werkzeug before 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is an application running on Windows with NTFS serving a user-specified path ending in a special device name such as NUL:.

Werkzeug, a comprehensive WSGI web application library, prior to version 3.1.4 allows path segments with Windows device names (e.g., CON, AUX) in its safe_join function. On Windows, a request for a path ending with such a name opens the file but reading hangs indefinitely. The issue is patched in version 3.1.4.