VYPR
← All advisories
High severityNVD Advisory· Published Jul 17, 2019· Updated Aug 5, 2024

CVE-2019-1010083

CVE-2019-1010083

Description

The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Flask before 1.0 is vulnerable to a denial of service via crafted JSON data that causes unexpected memory usage.

Vulnerability

Overview

CVE-2019-1010083 is a denial-of-service (DoS) vulnerability affecting the Pallets Project Flask framework in versions prior to 1.0. The root cause is that crafted, encoded JSON data can trigger unexpected memory consumption within the framework's request handling logic, leading to resource exhaustion. This issue may overlap with CVE-2018-1000656, indicating a similar or related class of problem [1][2].

Attack

Vector and Exploitation

The attack vector is network-based, requiring no authentication or special privileges. An attacker can send a specially crafted JSON payload to any endpoint that processes JSON data (e.g., using Flask's built-in request parsing). The attack complexity is low, as the crafted payload is straightforward to generate and does not require unusual conditions [2]. No user interaction is needed for exploitation.

Impact

Successful exploitation results in excessive memory usage, potentially exhausting available resources on the server and causing the application to become unresponsive or crash. This can lead to a denial of service for legitimate users. The vulnerability is rated with a CVSS v3 base score of 7.5 (High) due to the high availability impact [1].

Mitigation

The flaw was fixed in Flask version 1.0, released in April 2018 [3]. Users are strongly advised to upgrade to Flask 1.0 or later to mitigate the risk. No workarounds are documented; the only complete fix is to update the framework. The vulnerability is also listed in the GitHub Advisory Database [2] and PyPA's security advisory database [4].

References
  1. NVD - CVE-2019-1010083
  2. CVE-2019-1010083 - GitHub Advisory Database
  3. Pallets
  4. advisory-database/vulns/flask/PYSEC-2019-179.yaml at main · pypa/advisory-database

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
FlaskPyPI
< 1.01.0

Affected products

173

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.