All Flask CVEs — Complete Vulnerability History

Last updated: April 1, 2026 · Data: OSV Database

Flask is Python's most popular microframework. CVEs in Flask itself are rare — most Flask-related vulnerabilities come through Werkzeug or Jinja2. The main direct CVE is a cookie bypass.

Full CVE history

Current safe version: 3.0.3

# Before

"Flask==2.0.0"

# After

"Flask==3.0.3"

Then run: pip install -r requirements.txt

Flask CVEs — complete history

Flask has a small but important CVE history. Most vulnerabilities are in Werkzeug (Flask's WSGI toolkit) rather than Flask itself. Always update both together.

Known Flask and Werkzeug CVEs

Fix Flask and Werkzeug

# Always update Flask and Werkzeug together
pip install flask --upgrade werkzeug --upgrade

# Pin in requirements.txt
flask>=3.0.3
werkzeug>=3.0.6

pip install -r requirements.txt

# Verify
pip show flask werkzeug | grep -E "Name:|Version:"

Critical: disable the debugger in production

CVE-2024-34069 is a Werkzeug debugger PIN bypass that allows remote code execution. It only affects apps running with debug=True. Never run Flask with debug mode enabled in production.

# Never in production
app.run(debug=True)

# Always in production
app.run(debug=False)
# Or use environment variable
FLASK_DEBUG=0 flask run

Flask version history — safe versions