Vulnerabilities for Flask

First version without a known vulnerability: 3.1.3

Details

• GHSA-68rp-wp8r-47262026-02-19

  Flask session does not add `Vary: Cookie` header when accessed in some ways

  Fixed in: 3.1.3

• GHSA-4grg-w6v8-c28g2025-05-13

  Flask uses fallback key instead of current signing key

  Fixed in: 3.1.1

• GHSA-m2qf-hxjv-5gpq2023-05-01

  Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

  Fixed in: 2.3.2, 2.2.5, 70f906c51ce49c485f1d355703e9cc3386b1cc2b, afd63b16170b7c047f5758eb910c416511e9c965

• GHSA-5wv5-4vpf-pj6m2019-07-19

  Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage

  Fixed in: 1.0

• GHSA-562c-5r94-xh972018-08-23

  Flask is vulnerable to Denial of Service via incorrect encoding of JSON data

  Fixed in: 0.12.3