Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
TensorFlow 2.16.1-11 may cause file‑serve hangs on Windows
published 1 month ago
Summary
TensorFlow 2.16.1-11 uses a web library that can get stuck when a Windows system tries to serve a file named like the special device "NUL:". The request never completes, potentially freezing the application. Update the library to the latest version that includes the fix, or avoid serving user‑controlled paths that could contain such names.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | tensorflow | <= 2.16.1-11 |
Original advisory text
CVE-2026-102598 affecting package tensorflow 2.16.1-11
Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:. The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.
References
Timeline
Published29 Sep 2026
Updated3 Oct 2026
First seen3 Oct 2026
Sources
AZL-105921 · OSV
Track software like this
Free during beta