CVE-2018-1000656: Flask - Denial of Service via incorrect encoding of JSON data
Summary
CVE-2018-1000656: Flask is vulnerable to Denial of Service via incorrect encoding of JSON data. Affects flask versions < 0.12.3. Fixed in 0.12.3. How to fix ↓
Also tracked for
- flask · Debian:11
The same CVE-2018-1000656 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask is a popular web framework for Python that allows developers to build web applications. It provides a simple and flexible way to handle HTTP requests and responses. The vulnerability in Flask, identified as CVE-2018-1000656, is related to improper input validation when handling JSON data. This vulnerability can be exploited by an attacker who provides JSON data in incorrect encoding, leading to a large amount of memory usage and potentially causing a denial of service.
Vulnerability Detail
The vulnerability in Flask arises from the incorrect encoding of JSON data. When Flask processes JSON data, it fails to properly validate the encoding, which can result in excessive memory usage. An attacker can exploit this vulnerability by sending specially crafted JSON data with incorrect encoding, causing the application to consume a significant amount of memory and potentially leading to a denial of service. This vulnerability has been assigned a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 3.1.3 as of 22 Oct 2026
pip install --upgrade "flask==3.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.3
This is the first release that contains the fix.
pip install --upgrade "flask==0.12.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Flask to the fixed version to mitigate the risk of a denial of service attack.
Conclusion
Flask version Before 0.12.3 is vulnerable to a denial of service attack due to improper input validation when handling JSON data. It is crucial to update Flask to version 0.12.3 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask →
FAQ
Flask is a web framework for Python that allows developers to build web applications.
This vulnerability can lead to a denial of service if exploited by an attacker.
To fix this vulnerability, update Flask to version 0.12.3 or later.
No, there is no known workaround for this vulnerability. Updating Flask is the recommended solution.
The CVSS score of this vulnerability is 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask.
