flask
3.1.3The Python micro framework for building web applications.
- Maintenance
- Slow8 commits in 3 months · bus factor 2
- License
- BSD-3-ClausePermissive · OSI-approved
- Security
- 3 advisories1 high, 2 low · Scorecard 7.1/10
- Supported versions
- No scheduleendoflife.date does not track this project
75.1k stars · 17.3k forks · 4 open issues · last release 8 months ago · data checked 42 minutes ago
Security advisories
All advisories on GitHubThe 3 most recent advisories published by the maintainers: 1 high, 2 low. Check the patched version against the one you run.
- lowCVE-2026-27205Feb 19, 2026Flask session does not add `Vary: Cookie` header when accessed in some ways
- Affected
- <3.1.3
- Patched in
- 3.1.3
- lowCVE-2025-47278May 13, 2025fallback key is used instead of current signing key
- Affected
- 3.1.0
- Patched in
- 3.1.1
- highCVE-2023-30861May 1, 2023Possible disclosure of permanent session cookie due to missing Vary: Cookie header
- Affected
- <2.3.1
- Patched in
- 2.2.5, 2.3.2