CVE-2018-1000656

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.

• CWE-20

• https://github.com/pallets/flask/pull/2691Issue Tracking, Patch, Third Party Advisory
• https://github.com/pallets/flask/releases/tag/0.12.3Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00025.html
• https://security.netapp.com/advisory/ntap-20190221-0001/Patch, Third Party Advisory
• https://usn.ubuntu.com/4378-1/
• https://github.com/pallets/flask/pull/2691Issue Tracking, Patch, Third Party Advisory
• https://github.com/pallets/flask/releases/tag/0.12.3Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00025.html
• https://security.netapp.com/advisory/ntap-20190221-0001/Patch, Third Party Advisory
• https://usn.ubuntu.com/4378-1/

Published

Aug 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000650LibreHealthIO lh-ehr version REL-2.0.0 contains a SQL Inject…
• CVE-2018-1000651Stroom version <5.4.5 contains a XML External Entity (XXE) v…
• CVE-2018-1000652JabRef version <=4.3.1 contains a XML External Entity (XXE) …
• CVE-2018-1000653zzcms version 8.3 and earlier contains a SQL Injection vulne…
• CVE-2018-1000654GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libta…
• CVE-2018-1000655Jsish version 2.4.65 contains a CWE-476: NULL Pointer Derefe…
• CVE-2018-1000657Rust Programming Language Rust standard library version Comm…
• CVE-2018-1000658LimeSurvey version prior to 3.14.4 contains a file upload vu…
• CVE-2018-1000659LimeSurvey version 3.14.4 and earlier contains a directory t…
• CVE-2018-1000660TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb…
• CVE-2018-1000661jsish version 2.4.67 contains a CWE-476: NULL Pointer Derefe…
• CVE-2018-1000662Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…