GHSA-5wv5-4vpf-pj6m

Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage

Source: GitHub Advisory Database (reviewed) High CVE-2019-1010083

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Flask	< 1.0	1.0

Details

As written in the advisory (Markdown source, shown as plain text).

The Pallets Project Flask before 1.0 is affected by unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. The fixed version is 1. NOTE this may overlap CVE-2018-1000656.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-1010083 advisory
https://github.com/advisories/GHSA-5wv5-4vpf-pj6m advisory
https://github.com/pallets/flask package
https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2019-179.yaml web
https://www.palletsprojects.com/blog/flask-1-0-released web