CVE-2018-1000656: Input Validation
Published Aug 20, 2018
·Updated
Last updated 25 August 2025
Other sources
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
— GitHub
Affected Software
6 affected componentsFixes available
pip/flask<0.12.3
0.12.3
palletsprojects Flask<0.12.3
NetApp Active Iq
NetApp Hyper Converged Infrastructure
NetApp Ontap Select Deploy Utility
debian/flask
1.1.2-2+deb11u12.2.2-33.1.1-13.1.2-1
Remediation
Patch Available
Patch Available
Event History
Aug 20, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:31 PM
RemedyDescriptionSeverityWeaknessAffected Software
Aug 23, 2018
Advisory Published
via GitHub·07:10 PM
Jan 11, 2024
Data Sourced
via Launchpad·10:45 PM
Description
Feb 20, 2026
Data Sourced
via Ubuntu·03:42 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·03:43 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2018-1000656.
2
What is the severity of CVE-2018-1000656?
The severity of CVE-2018-1000656 is high with a CVSS score of 7.5.
3
What is the affected software for CVE-2018-1000656?
The affected software for CVE-2018-1000656 is Flask version before 0.12.3.
4
How can CVE-2018-1000656 be exploited?
CVE-2018-1000656 can be exploited by providing JSON data in incorrect encoding.
5
How can I fix CVE-2018-1000656?
To fix CVE-2018-1000656, upgrade to Flask version 0.12.3 or later.