CVE catalog

CVE-2026-27205

Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Us

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.40% · Oct 25, 2026

Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianflasksid3.1.3-4fixed
Debianflaskforky3.1.3-4fixed
Debianflasktrixie3.1.1-1+deb13u1fixed
Debianflaskbookworm2.2.2-3vulnerable
PipflaskNot reported3.1.3fixed
CpeflaskNot reportedNot reportedvulnerable
CpeflaskNot reported3.0.2-1ubuntu1.1fixed
Cpepython-flask-docNot reported3.0.2-1ubuntu1.1fixed
Cpepython3-flaskNot reported3.0.2-1ubuntu1.1fixed
PyPIflaskNot reported3.1.3fixed
Susepython-Flasklinux enterprise server 16.03.1.1-160000.3.1fixed
Susepython-Flasklinux enterprise server for sap applications 16.03.1.1-160000.3.1fixed
Ubuntuflaskpro1.0.2-3vulnerable
Ubuntuflaskpro1.1.1-2vulnerable
Ubuntuflaskpro1.1.1-2ubuntu0.1vulnerable
Ubuntuflaskpro1.1.1-2ubuntu0.1+esm1fixed
Ubuntuflask22.041.1.2-2vulnerable
Ubuntuflask22.042.0.1-2ubuntu1vulnerable
Ubuntuflask22.042.0.1-2ubuntu1.1vulnerable
Ubuntuflask22.042.0.1-2ubuntu1.2fixed
Ubuntuflask24.042.2.5-1ubuntu1vulnerable
Ubuntuflask24.043.0.2-1ubuntu1vulnerable
Ubuntuflask24.043.0.2-1ubuntu1.1fixed
Opensusepython-Flasktumbleweed3.1.3-1.1fixed
Ubuntuflask16.040.10.1-2build2vulnerable
Ubuntuflask16.040.10.1-2ubuntu0.1vulnerable
Ubuntuflask18.040.12.2-2vulnerable
Ubuntuflask18.040.12.2-3vulnerable
Ubuntuflask18.040.12.2-3ubuntu0.1vulnerable
Ubuntuflaskpro1.0.2-3vulnerable
Ubuntuflaskpro1.1.1-2vulnerable
Ubuntuflaskpro1.1.1-2ubuntu0.1vulnerable
Ubuntuflaskpro1.1.1-2ubuntu0.1+esm1fixed
Ubuntuflask22.041.1.2-2vulnerable
Ubuntuflask22.042.0.1-2ubuntu1vulnerable
Ubuntuflask22.042.0.1-2ubuntu1.1vulnerable
Ubuntuflask22.042.0.1-2ubuntu1.2fixed
Ubuntuflask24.042.2.5-1ubuntu1vulnerable
Ubuntuflask24.043.0.2-1ubuntu1vulnerable
Ubuntuflask24.043.0.2-1ubuntu1.1fixed
Ubuntuflask25.103.1.0-2ubuntu1vulnerable
Ubuntuflask25.103.1.1-1ubuntu1vulnerable
Ubuntuflask25.103.1.2-1ubuntu1vulnerable
Susepython-Flasklinux enterprise module for python 3 15 sp72.3.2-150400.3.9.1fixed
Opensusepython-Flaskleap 15.62.3.2-150400.3.9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianflasksourcesid3.1.3-1not yet assignedNot reported[1128620]
Debianflasksourceforky3.1.3-1not yet assignedNot reported[1128620]
Debianflasksourcetrixie3.1.1-1+deb13u1not yet assignedNot reported[1128620]
Debianflasksourcebookworm(unfixed)not yet assignedNot reported[1128620]
PipflaskpipNot reported3.1.3Not reportedNot reportedNot reported
CpeflaskcpeNot reported3.0.2-1ubuntu1.1Not reportedNot reportedNot reported
Cpepython-flask-doccpeNot reported3.0.2-1ubuntu1.1Not reportedNot reportedNot reported
Cpepython3-flaskcpeNot reported3.0.2-1ubuntu1.1Not reportedNot reportedNot reported
PyPIflaskPyPINot reported3.1.3Not reportedGHSA-68RP-WP8R-4726Not reported
Susepython-Flaskrpmlinux enterprise server 16.03.1.1-160000.3.1Not reportedSUSE-SU-2026:22023-1Not reported
Susepython-Flaskrpmlinux enterprise server for sap applications 16.03.1.1-160000.3.1Not reportedSUSE-SU-2026:22023-1Not reported
Ubuntuflaskdebpro1.1.1-2ubuntu0.1+esm1Not reportedUSN-8104-1Not reported
Ubuntuflaskdeb22.042.0.1-2ubuntu1.2Not reportedUSN-8104-1Not reported
Ubuntuflaskdeb24.043.0.2-1ubuntu1.1Not reportedUSN-8104-1Not reported
Opensusepython-Flaskrpmtumbleweed3.1.3-1.1Not reportedOPENSUSE-SU-2026:10264-1Not reported
Ubuntuflaskdebpro1.1.1-2ubuntu0.1+esm1Not reportedUBUNTU-CVE-2026-27205Not reported
Ubuntuflaskdeb22.042.0.1-2ubuntu1.2Not reportedUBUNTU-CVE-2026-27205Not reported
Ubuntuflaskdeb24.043.0.2-1ubuntu1.1Not reportedUBUNTU-CVE-2026-27205Not reported
Susepython-Flaskrpmlinux enterprise module for python 3 15 sp72.3.2-150400.3.9.1Not reportedSUSE-SU-2026:0849-1Not reported
Opensusepython-Flaskrpmleap 15.62.3.2-150400.3.9.1Not reportedSUSE-SU-2026:0849-1Not reported

[Debian bug #1128620]

Notes

[bookworm] flask: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-flask]Affected

    Source package: [flask]

    Details (2)

    • 2.2.2-3 · all · bookworm

      Affected

      nvd · flask · debian · bookworm; nvd · flask · debian · 12

    • 2.2.2-3 · all · bookworm

      Affected

      nvd · flask · debian · bookworm; nvd · flask · debian · 12

  • [python-flask-doc]Affected

    Source package: [flask]

    Details (2)

    • 2.2.2-3 · all · bookworm

      Affected

      nvd · flask · debian · bookworm; nvd · flask · debian · 12

    • 2.2.2-3 · all · bookworm

      Affected

      nvd · flask · debian · bookworm; nvd · flask · debian · 12

[Debian 13 (Trixie)]

  • [python3-flask]Affected

    Source package: [flask]

    Details (2)

    • 3.1.1-1 · all · trixie

      Affected · Fixed: 3.1.1-1+deb13u1

      nvd · flask · debian · 13

    • 3.1.1-1 · all · trixie

      Affected · Fixed: 3.1.1-1+deb13u1

      nvd · flask · debian · 13

  • [python-flask-doc]Affected

    Source package: [flask]

    Details (2)

    • 3.1.1-1 · all · trixie

      Affected · Fixed: 3.1.1-1+deb13u1

      nvd · flask · debian · 13

    • 3.1.1-1 · all · trixie

      Affected · Fixed: 3.1.1-1+deb13u1

      nvd · flask · debian · 13

[openSUSE Tumbleweed]

  • [python313-Flask]Unknown

    Source package: [python-Flask]

    Details (1)

    • 3.1.3-2.2 · noarch · tumbleweed

      Unknown · Fixed: 3.1.3-1.1

      Version impact unknown

      nvd · python-Flask · opensuse · tumbleweed

  • [python313-Flask-doc]Unknown

    Source package: [python-Flask]

    Details (1)

    • 3.1.3-2.2 · noarch · tumbleweed

      Unknown · Fixed: 3.1.3-1.1

      Version impact unknown

      nvd · python-Flask · opensuse · tumbleweed

  • [python314-Flask]Unknown

    Source package: [python-Flask]

    Details (1)

    • 3.1.3-2.2 · noarch · tumbleweed

      Unknown · Fixed: 3.1.3-1.1

      Version impact unknown

      nvd · python-Flask · opensuse · tumbleweed

  • [python314-Flask-doc]Unknown

    Source package: [python-Flask]

    Details (1)

    • 3.1.3-2.2 · noarch · tumbleweed

      Unknown · Fixed: 3.1.3-1.1

      Version impact unknown

      nvd · python-Flask · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]