This PR contains the following updates:

Package	Change	Age	Confidence
Flask (changelog)	==2.2.5 → ==3.1.3
flask (changelog)	==2.2.5 → ==3.1.3
flask (changelog)	==3.0.3 → ==3.1.3

---

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

CVE-2023-30861 / GHSA-m2qf-hxjv-5gpq

More information

Details

When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
2. The application sets session.permanent = True.
3. The application does not access or modify the session at any point during a request.
4. SESSION_REFRESH_EACH_REQUEST is enabled (the default).
5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
• https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b
• https://github.com/pallets/flask/releases/tag/2.3.2
• https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965
• https://nvd.nist.gov/vuln/detail/CVE-2023-30861
• https://github.com/pallets/flask/releases/tag/2.2.5
• https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2023-62.yaml
• https://www.debian.org/security/2023/dsa-5442
• https://lists.debian.org/debian-lts-announce/2023/08/msg00024.html
• https://security.netapp.com/advisory/ntap-20230818-0006
• https://github.com/advisories/GHSA-m2qf-hxjv-5gpq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Flask session does not add Vary: Cookie header when accessed in some ways

CVE-2026-27205 / GHSA-68rp-wp8r-4726

More information

Details

When the session object is accessed, Flask should set the Vary: Cookie header. This instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked.

The severity depends on the application's use of the session, and the cache's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not ignore responses with cookies.
2. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.
3. The application accesses the session in a way that does not access the values, only the keys, and does not mutate the session.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726
• https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4
• https://github.com/pallets/flask/releases/tag/3.1.3
• https://nvd.nist.gov/vuln/detail/CVE-2026-27205
• https://github.com/advisories/GHSA-68rp-wp8r-4726

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pallets/flask (Flask)

v3.1.3

Compare Source

Released 2026-02-18

• The session is marked as accessed for operations that only access the keys
  but not the values, such as in and len. :ghsa:68rp-wp8r-4726

v3.1.2

Compare Source

Released 2025-08-19

• stream_with_context does not fail inside async views. :issue:5774
• When using follow_redirects in the test client, the final state
  of session is correct. :issue:5786
• Relax type hint for passing bytes IO to send_file. :issue:5776

v3.1.1

Compare Source

Released 2025-05-13

• Fix signing key selection order when key rotation is enabled via
  SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
• Fix type hint for cli_runner.invoke. :issue:5645
• flask --help loads the app and plugins first to make sure all commands
  are shown. :issue:5673
• Mark sans-io base class as being able to handle views that return
  AsyncIterable. This is not accurate for Flask, but makes typing easier
  for Quart. :pr:5659

v3.1.0

Compare Source

Released 2024-11-13

• Drop support for Python 3.8. :pr:5623
• Update minimum dependency versions to latest feature releases.
  Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633
• Provide a configuration option to control automatic option
  responses. :pr:5496
• Flask.open_resource/open_instance_resource and
  Blueprint.open_resource take an encoding parameter to use when
  opening in text mode. It defaults to utf-8. :issue:5504
• Request.max_content_length can be customized per-request instead of only
  through the MAX_CONTENT_LENGTH config. Added
  MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation
  about resource limits to the security page. :issue:5625
• Add support for the Partitioned cookie attribute (CHIPS), with the
  SESSION_COOKIE_PARTITIONED config. :issue:5472
• -e path takes precedence over default .env and .flaskenv files.
  load_dotenv loads default files in addition to a path unless
  load_defaults=False is passed. :issue:5628
• Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old
  secret keys that can still be used for unsigning. Extensions will need to
  add support. :issue:5621
• Fix how setting host_matching=True or subdomain_matching=False
  interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts
  requests to only that domain. :issue:5553
• Request.trusted_hosts is checked during routing, and can be set through
  the TRUSTED_HOSTS config. :issue:5636

v3.0.3

Compare Source

Released 2024-04-07

• The default hashlib.sha1 may not be available in FIPS builds. Don't
  access it at import time so the developer has time to change the default.
  :issue:5448
• Don't initialize the cli attribute in the sansio scaffold, but rather in
  the Flask concrete class. :pr:5270

v3.0.2

Compare Source

Released 2024-02-03

• Correct type for jinja_loader property. :issue:5388
• Fix error with --extra-files and --exclude-patterns CLI options.
  :issue:5391

v3.0.1

Compare Source

Released 2024-01-18

• Correct type for path argument to send_file. :issue:5336
• Fix a typo in an error message for the flask run --key option. :pr:5344
• Session data is untagged without relying on the built-in json.loads
  object_hook. This allows other JSON providers that don't implement that.
  :issue:5381
• Address more type findings when using mypy strict mode. :pr:5383

v3.0.0

Compare Source

Released 2023-09-30

• Remove previously deprecated code. :pr:5223
• Deprecate the __version__ attribute. Use feature detection, or
  importlib.metadata.version("flask"), instead. :issue:5230
• Restructure the code such that the Flask (app) and Blueprint
  classes have Sans-IO bases. :pr:5127
• Allow self as an argument to url_for. :pr:5264
• Require Werkzeug >= 3.0.0.

v2.3.3

Compare Source

Released 2023-08-21

• Python 3.12 compatibility.
• Require Werkzeug >= 2.3.7.
• Use flit_core instead of setuptools as build backend.
• Refactor how an app's root and instance paths are determined. :issue:5160

v2.3.2

Compare Source

Released 2023-05-01

• Set Vary: Cookie header when the session is accessed, modified, or refreshed.
• Update Werkzeug requirement to >=2.3.3 to apply recent bug fixes.
  :ghsa:m2qf-hxjv-5gpq

v2.3.1

Compare Source

Released 2023-04-25

• Restore deprecated from flask import Markup. :issue:5084

v2.3.0

Compare Source

Released 2023-04-25

• Drop support for Python 3.7. :pr:5072

• Update minimum requirements to the latest versions: Werkzeug>=2.3.0, Jinja2>3.1.2,
  itsdangerous>=2.1.2, click>=8.1.3.

• Remove previously deprecated code. :pr:4995

  • The push and pop methods of the deprecated _app_ctx_stack and
    _request_ctx_stack objects are removed. top still exists to give
    extensions more time to update, but it will be removed.
  • The FLASK_ENV environment variable, ENV config key, and app.env
    property are removed.
  • The session_cookie_name, send_file_max_age_default, use_x_sendfile,
    propagate_exceptions, and templates_auto_reload properties on app
    are removed.
  • The JSON_AS_ASCII, JSON_SORT_KEYS, JSONIFY_MIMETYPE, and
    JSONIFY_PRETTYPRINT_REGULAR config keys are removed.
  • The app.before_first_request and bp.before_app_first_request decorators
    are removed.
  • json_encoder and json_decoder attributes on app and blueprint, and the
    corresponding json.JSONEncoder and JSONDecoder classes, are removed.
  • The json.htmlsafe_dumps and htmlsafe_dump functions are removed.
  • Calling setup methods on blueprints after registration is an error instead of a
    warning. :pr:4997

• Importing escape and Markup from flask is deprecated. Import them
  directly from markupsafe instead. :pr:4996

• The app.got_first_request property is deprecated. :pr:4997

• The locked_cached_property decorator is deprecated. Use a lock inside the
  decorated function if locking is needed. :issue:4993

• Signals are always available. blinker>=1.6.2 is a required dependency. The
  signals_available attribute is deprecated. :issue:5056

• Signals support async subscriber functions. :pr:5049

• Remove uses of locks that could cause requests to block each other very briefly.
  :issue:4993

• Use modern packaging metadata with pyproject.toml instead of setup.cfg.
  :pr:4947

• Ensure subdomains are applied with nested blueprints. :issue:4834

• config.from_file can use text=False to indicate that the parser wants a
  binary file instead. :issue:4989

• If a blueprint is created with an empty name it raises a ValueError.
  :issue:5010

• SESSION_COOKIE_DOMAIN does not fall back to SERVER_NAME. The default is not
  to set the domain, which modern browsers interpret as an exact match rather than
  a subdomain match. Warnings about localhost and IP addresses are also removed.
  :issue:5051

• The routes command shows each rule's subdomain or host when domain
  matching is in use. :issue:5004

• Use postponed evaluation of annotations. :pr:5071

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.