is flask hello world with gunicorn behind apache vulnerable?

Only decompression with Google's brotli library is affected. So if you use "Brotli" or "brotlicffi" in your Python app to decompress brotli, you're vulnerable. Compressing responses with brotli from Apache is safe.

what I can say is that a 5 liner hello world starting with ‘import socket’ is not affected

whether a hello wolrd in fastapi is affected might also be interesting