DEBIAN-CVE-2026-27205
Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.
DEBIAN-CVE-2026-27205
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-27205
flask
Source reference: /affected/0/package/name
- Affected versions
- 2.2.2-3
Source reference:
/affected/0/versions2.2.5-1Source reference:
/affected/0/versions3.0.0-1Source reference:
/affected/0/versions3.0.1-1Source reference:
/affected/0/versions3.0.2-1Source reference:
/affected/0/versions3.0.3-1Source reference:
/affected/0/versions3.1.0-1Source reference:
/affected/0/versions3.1.0-2Source reference:
/affected/0/versions3.1.1-1Source reference:
/affected/0/versions3.1.2-1Source reference:
/affected/0/versions3.1.3-1Source reference:
/affected/0/versions3.1.3-2Source reference:
/affected/0/versions3.1.3-3Source reference:
/affected/0/versions3.1.3-4Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
flask
Source reference: /affected/1/package/name
- Affected versions
- 3.1.1-1
Source reference:
/affected/1/versions - Fixed versions
- 3.1.1-1+deb13u1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
flask
Source reference: /affected/2/package/name
- Affected versions
- 3.1.1-1
Source reference:
/affected/2/versions3.1.2-1Source reference:
/affected/2/versions - Fixed versions
- 3.1.3-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "flask",
"purl": "pkg:deb/debian/flask?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.2.2-3",
"2.2.5-1",
"3.0.0-1",
"3.0.1-1",
"3.0.2-1",
"3.0.3-1",
"3.1.0-1",
"3.1.0-2",
"3.1.1-1",
"3.1.2-1",
"3.1.3-1",
"3.1.3-2",
"3.1.3-3",
"3.1.3-4"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27205.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.1-1+deb13u1"
}
]
}
],
"package": {
"name": "flask",
"purl": "pkg:deb/debian/flask?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.1.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27205.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.3-1"
}
]
}
],
"package": {
"name": "flask",
"purl": "pkg:deb/debian/flask?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.1.1-1",
"3.1.2-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-27205.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56312 · Revision 1
- Added to Heist Feed
- Publisher date