https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:49:05 +0000 https://db.gcve.eu/vuln/ghsa-68rp-wp8r-4726 <p><strong>Affected:</strong> PyPI: flask</p> <p>When the `session` object is accessed, Flask should set the `Vary: Cookie` header. This instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python `in` operator were overlooked.</p> <p>The severity depends on the application&#39;s use of the session, and the cache&#39;s behavior regarding cookies. The risk depends on all these conditions being met.</p> <p>1. The application must be hosted behind a caching proxy that does not ignore responses with cookies. 2. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. 3. The application accesses the session in a way that does not access the values, only the keys, and does not mutate the session.</p> <p><strong>Affected:</strong> PyPI: flask</p> <p>When the `session` object is accessed, Flask should set the `Vary: Cookie` header. This instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python `in` operator were overlooked.</p> <p>The severity depends on the application&#39;s use of the session, and the cache&#39;s behavior regarding cookies. The risk depends on all these conditions being met.</p> <p>1. The application must be hosted behind a caching proxy that does not ignore responses with cookies. 2. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. 3. The application accesses the session in a way that does not access the values, only the keys, and does not mutate the session.</p> https://db.gcve.eu/vuln/ghsa-68rp-wp8r-4726