CVE-2019-1010083

HIGH

Flask < 1.0 - Denial of Service via Crafted JSON Data

Title source: llm

Description

The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.

References (1)

Core 1

Core References

Release Notes, Vendor Advisory x_refsource_confirm

https://www.palletsprojects.com/blog/flask-1-0-released/

Scores

CVSS v3 7.5

EPSS 0.0188

EPSS Percentile 77.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

Status published

Products (2)

palletsprojects/flask < 1.0

pypi/Flask 0 - 1.0PyPI

Published Jul 17, 2019

Tracked Since Feb 18, 2026