python-flask: Denial of Service via crafted JSON file

🗓️ 17 Mar 2020 17:12:40Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 8 Views

Flask prior to 0.12.3 has a denial of service from improper input validation of crafted data format.

Reporter	Title	Published	Views	Family All 87
IBM Security Bulletins	Security Bulletin: IBM QRadar Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	29 Apr 202416:48	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Pyyaml	29 Aug 202510:27	–	githubexploit
Tenable Nessus	CentOS 7 : python-flask (RHSA-2020:0870)	9 Oct 202400:00	–	nessus
Tenable Nessus	Debian DLA-1892-1 : flask security update	21 Aug 201900:00	–	nessus
Tenable Nessus	Flask < 0.12.3 Denial of Service Vulnerability	19 Dec 201800:00	–	nessus
Tenable Nessus	MiracleLinux 7 : python-flask-0.10.1-5.el7 (AXSA:2020-4499:01)	20 Jan 202600:00	–	nessus
Tenable Nessus	openSUSE Security Update : python-Flask (openSUSE-2019-1112)	3 Apr 201900:00	–	nessus
Tenable Nessus	Oracle Business Intelligence Enterprise Edition (OAS) (Apr 2023 CPU)	25 Apr 202300:00	–	nessus
Tenable Nessus	RHEL 7 : python-flask (RHSA-2020:0870)	18 Mar 202000:00	–	nessus
Tenable Nessus	SUSE SLES12 Security Update : python-Flask (SUSE-SU-2023:1928-1)	21 Apr 202300:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	any	python-flask	1:0.10.1-5.el7_7	python-flask-1:0.10.1-5.el7_7.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2018-1000656
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-1000656
cve	www.cve.org/CVERecord

21 Nov 2025 18:12Current

7.1High risk

Vulners AI Score7.1

CVSS 25

CVSS 37.5

EPSS0.03855

denial of service flask vulnerability improper input validation crafted data format version 0.12.3