CVE-2018-1000656: Flask Improper Input Validation
Summary
CVE-2018-1000656: The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. Affects flask versions < 0.12.3. Fixed in 0.12.3. How to fix ↓
Also tracked for
- flask · Debian:11
The same CVE-2018-1000656 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask is a popular Python web framework that provides a simple and flexible way to build web applications. It is widely used for developing small to large-scale projects due to its lightweight nature and extensive ecosystem. However, versions before 0.12.3 of Flask are vulnerable to an Improper Input Validation issue (CWE-20).
Vulnerability Detail
The vulnerability in Flask arises from improper input validation when processing JSON data in incorrect encoding. An attacker can exploit this by providing specially crafted JSON data, leading to a large amount of memory usage. This excessive memory consumption can potentially result in a denial of service (DoS) attack. It is important to note that this vulnerability may overlap with CVE-2019-1010083.
How To Fix
Latest published version: 3.1.3 as of 22 Oct 2026
pip install --upgrade "flask==3.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.3
This is the first release that contains the fix.
pip install --upgrade "flask==0.12.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Flask versions before 0.12.3 are vulnerable to an Improper Input Validation issue that can lead to a denial of service attack. It is crucial to update Flask to version 0.12.3 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask →
FAQ
Flask is a lightweight web framework for Python that allows developers to build web applications quickly and efficiently.
CWE-20 is a Common Weakness Enumeration category that refers to improper input validation vulnerabilities, where user-supplied input is not properly validated or sanitized.
The vulnerability in Flask can lead to a denial of service (DoS) attack by causing excessive memory usage. This can result in the unavailability of the affected application or system.
Yes, upgrading Flask to version 0.12.3 or later will fix this vulnerability. It is recommended to update the Flask package in your Python environment.
You can find more information about this vulnerability in the official Flask advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/flask/PYSEC-2018-66.yaml
Related vulnerabilities
Recent vulnerabilities recorded for flask.
