CVE-2018-1000656
Flask is vulnerable to Denial of Service via incorrect encoding of JSON data
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
- Record
CVE-2018-1000656- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
- Record
CVE-2018-1000656- Updated
- 2026-11-02
EUVDEUVD-2018-0075 No score
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
- Record
EUVD-2018-0075- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-562c-5r94-xh97
Flask is vulnerable to Denial of Service via incorrect encoding of JSON data
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
- Record
GHSA-562c-5r94-xh97- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
- Record
CVE-2018-1000656- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1000656
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
- Record
DEBIAN-CVE-2018-1000656- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-562c-5r94-xh97
Flask is vulnerable to Denial of Service via incorrect encoding of JSON data
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
- Record
GHSA-562c-5r94-xh97- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRHSA-2020:0870
Red Hat Security Advisory: python-flask security update
- Record
RHSA-2020:0870- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1000656
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
- Record
UBUNTU-CVE-2018-1000656- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1112-1 No score
Security update for python-Flask
This update for python-Flask to version 0.12.4 fixes the following issues:
Security issue fixed:
- CVE-2018-1000656: Fixed an improper input validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. (bsc#1106279)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1112-1- Updated
- 2026-11-02
OSVPYSEC-2018-66 No score
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.
- Record
PYSEC-2018-66- Updated
- 2026-11-02
OSVSUSE-SU-2019:0657-1 No score
Security update for python-Flask
This update for python-Flask to version 0.12.4 fixes the following issues:
Security issue fixed:
- CVE-2018-1000656: Fixed an improper input validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. (bsc#1106279)
- Record
SUSE-SU-2019:0657-1- Updated
- 2026-11-02
OSVUSN-4378-1 No score
flask vulnerability
It was discovered that Flask incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.
- Record
USN-4378-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flaskPyPI |
before 0.12.3 | 0.12.3 |
flaskDebian:12 |
before 1.0.2-1 | 1.0.2-1 |
flaskDebian:13 |
before 1.0.2-1 | 1.0.2-1 |
flaskDebian:14 |
before 1.0.2-1 | 1.0.2-1 |
flaskDebian:8 |
before 0.10.1-2+deb8u1, plus listed versions 0.10.1-2 |
0.10.1-2+deb8u1 |
flaskPyPI |
before 0.12.3, plus listed versions 0.10.100.10.10.110.11.1 Show 18 moreShow less0.120.12.10.12.20.20.30.3.10.40.50.5.10.5.20.60.6.10.70.7.10.7.20.80.8.10.9 |
0.12.3 |
python-flaskRed Hat:rhel_extras_other:7 |
before 1:0.10.1-5.el7_7 | 1:0.10.1-5.el7_7 |
python-FlaskSUSE:Linux Enterprise Module for Basesystem 15 |
before 0.12.4-3.3.26 | 0.12.4-3.3.26 |
python-FlaskSUSE:Linux Enterprise Module for Package Hub 15 |
before 0.12.4-3.3.26 | 0.12.4-3.3.26 |
flaskUbuntu:Pro:14.04:LTS |
before 0.10.1-2ubuntu0.1~esm1, plus listed versions 0.10.1-20.10.1-2build1 |
0.10.1-2ubuntu0.1~esm1 |
flaskUbuntu:16.04:LTS |
before 0.10.1-2ubuntu0.1, plus listed versions 0.10.1-2build2 |
0.10.1-2ubuntu0.1 |
flaskUbuntu:18.04:LTS |
before 0.12.2-3ubuntu0.1, plus listed versions 0.12.2-20.12.2-3 |
0.12.2-3ubuntu0.1 |
python-FlaskopenSUSE:Leap 15.0 |
before 0.12.4-lp150.2.3.1 | 0.12.4-lp150.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000656 is a high vulnerability (CVSS 7.5) in Palletsprojects Flask, published August 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.85%, the 90th percentile. Fixed in flask 0.12.3.
References
security.netapp.com/advisory/ntap-20190221-0001
github.com/pallets/flask/pull/2691
lists.debian.org/debian-lts-announce/2019/08/msg00025.html
usn.ubuntu.com/4378-1
nvd.nist.gov/vuln/detail/CVE-2018-1000656
Show 17 moreShow less
security-tracker.debian.org/tracker/CVE-2018-1000656
access.redhat.com/errata/RHSA-2020:0870
bugzilla.redhat.com/show_bug.cgi?id=1623131
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0870.json
cve.org/CVERecord?id=CVE-2018-1000656
suse.com/support/update/announcement/2019/suse-su-20190657-1
bugzilla.suse.com/1106279
ubuntu.com/security/CVE-2018-1000656
lists.opensuse.org/archives/list/[email protected]/thread/QUU23JPF524WRYT6P2BYP5R5F5XP2QR2