CVE-2024-6866
published 2025-03-20CVE-2024-6866: corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.64%
47.0th percentile
corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| corydolphin | corydolphin_flask-cors | unspecified – latest | — |
| debian | python-flask-cors | < python-flask-cors 3.0.10-2+deb12u1 (bookworm) | python-flask-cors 3.0.10-2+deb12u1 (bookworm) |
| flask-cors_project | flask-cors | — | — |
| flask-cors_project | flask-cors | >= 0 < 6.0.0 | 6.0.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-flask-cors vulnerabilities
osv·2025-07-02·CVSS 5.3
CVE-2024-6839 [MEDIUM] python-flask-cors vulnerabilities
python-flask-cors vulnerabilities
It was discovered that Flask-CORS did not correctly handle certain regular
expressions. A remote attacker could possibly use this issue to leak
sensitive information or bypass authentication mechanisms. (CVE-2024-6839)
It was discovered that Flask-CORS allowed certain CORS headers to be
enabled by default. A remote attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221) It was
discovered that Flask-CORS did not correctly handle case sensitivity when
matching paths. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-6866) It was discovered that Flask-CORS
did not correctly handle certain charact
GHSA
Flask-CORS vulnerable to Improper Handling of Case Sensitivity
ghsa·2025-03-20
CVE-2024-6866 [MEDIUM] CWE-178 Flask-CORS vulnerable to Improper Handling of Case Sensitivity
Flask-CORS vulnerable to Improper Handling of Case Sensitivity
corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
OSV
Flask-CORS vulnerable to Improper Handling of Case Sensitivity
osv·2025-03-20
CVE-2024-6866 [MEDIUM] Flask-CORS vulnerable to Improper Handling of Case Sensitivity
Flask-CORS vulnerable to Improper Handling of Case Sensitivity
corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
OSV
CVE-2024-6866: corydolphin/flask-cors version 4
osv·2025-03-20·CVSS 7.5
CVE-2024-6866 [HIGH] CVE-2024-6866: corydolphin/flask-cors version 4
corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
Ubuntu
Flask-CORS vulnerabilities
vendor_ubuntu·2025-07-02·CVSS 5.3
CVE-2024-6839 [MEDIUM] Flask-CORS vulnerabilities
Title: Flask-CORS vulnerabilities
Summary: Several security issues were fixed in Flask-CORS.
It was discovered that Flask-CORS did not correctly handle certain regular
expressions. A remote attacker could possibly use this issue to leak
sensitive information or bypass authentication mechanisms. (CVE-2024-6839)
It was discovered that Flask-CORS allowed certain CORS headers to be
enabled by default. A remote attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-6221) It was
discovered that Flask-CORS did not correctly handle case sensitivity when
matching paths. A remote attacker could possibly use this issue to leak
sensitive information. (CVE-2024-6866) It was discove
Debian
CVE-2024-6866: python-flask-cors - corydolphin/flask-cors version 4.01 contains a vulnerability where the request p...
vendor_debian·2024·CVSS 7.5
CVE-2024-6866 [HIGH] CVE-2024-6866: python-flask-cors - corydolphin/flask-cors version 4.01 contains a vulnerability where the request p...
corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
Scope: local
bookworm: resolved (fixed in 3.0.10-2+deb12u1)
bullseye: resolved (fixed in 3.0.9-2+deb11u1)
forky: resolved (fixed in 6.0.0-1)
sid: resolved (fixed in 6.0.0-1)
trixie: resolved (fixed in 6.0.0-1)
No detection rules found.
No public exploits indexed.
2025-03-20
Published