Read the docs
TI-2024-06341 Aliases CVE-2024-6839GHSA-7rxf-gvfg-47g4

Improper Regex Path Matching in corydolphin/flask-cors

Priority MEDIUM 57CWE-41Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0074 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed flask-cors (PyPI): 6.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
corydolphincorydolphin/flask-corsup to latest—No fix listedCNA
—flask-cors (PyPI)before 6.0.06.0.0Patch availableGHSA-7rxf-gvfg-47g4
  • corydolphin/flask-cors Vendorcorydolphin Affected up to latest Fixed in — No fix listed CNA
  • flask-cors (PyPI) Vendor— Affected before 6.0.0 Fixed in 6.0.0 Patch available GHSA-7rxf-gvfg-47g4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:flask-cors_project:flask-cors:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableFlask-cors Project
  • cpe:2.3:a:flask-cors_project:flask-cors:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Flask-cors Project

Remediation

  • Fix · GHSA-7rxf-gvfg-47g4 flask-cors (PyPI) Fixed in 6.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6839
  2. 2026-10-03 Alias added: GHSA-7rxf-gvfg-47g4

References

Exploit 1

Advisory 1

Other 4

  • TI-2024-06367 Case-Insensitive Path Matching in corydolphin/flask-cors CVSS 3.1HIGH 7.5
  • TI-2024-05769 Improper Access Control in corydolphin/flask-cors CVSS 3.1HIGH 7.5
  • TI-2024-06346 Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors CVSS 3.0MEDIUM 5.3
  • TI-2024-01562 Log Injection Vulnerability in corydolphin/flask-cors CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences