Flask Package Vulnerability: Key Rotation Issue in Version 3.1.0
Summary
UBUNTU-CVE-2025-47278: Flask is a web server gateway interface (WSGI) web application framework. Affects flask versions < 3.1.0-2ubuntu1.1. Fixed in 3.1.0-2ubuntu1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask is a popular web server gateway interface (WSGI) web application framework that allows developers to build web applications quickly and efficiently. It is known for its simplicity and flexibility, making it a preferred choice for many developers. However, in version 3.1.0, Flask introduced a vulnerability related to the handling of fallback key configuration, which could lead to security concerns for applications that utilize key rotation.
Vulnerability Detail
In Flask version 3.1.0, the framework mishandled the configuration of fallback keys, resulting in the last fallback key being used for signing instead of the current signing key. This issue arises from the way the itsdangerous library constructs the list of keys, expecting the last key to be the most recent. As a result, sites using key rotation with the SECRET_KEY_FALLBACKS setting may inadvertently sign sessions with outdated keys, potentially compromising the security of session management. Although sessions remain signed, this flaw does not lead to data integrity loss, but it does impede the transition to newer keys.
How To Fix
Minimum fixed version
3.1.0-2ubuntu1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade flaskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if you cannot update Flask immediately, consider disabling key rotation by not setting the SECRET_KEY_FALLBACKS configuration. However, this is not a long-term solution and should be addressed by updating to the patched version as soon as possible.
Conclusion
The Flask vulnerability in version 3.1.0 poses a risk to applications utilizing key rotation, as it may lead to the use of outdated signing keys. It is crucial to update to version 3.1.1 or later to mitigate this risk and ensure the security of session management.
See every vulnerability recorded for flask →
FAQ
The vulnerability can lead to applications signing sessions with outdated keys, which may affect the security of session management.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
No, while sessions are still signed, there is no data integrity loss associated with this vulnerability.
As a temporary measure, you can disable key rotation by not using the SECRET_KEY_FALLBACKS configuration.
More details can be found in the official Ubuntu security notice at https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47278.json.
Related vulnerabilities
Recent vulnerabilities recorded for flask.
