Read the docs
TI-2024-06367 Aliases CVE-2024-6866GHSA-43qf-4rqw-9q2g

Case-Insensitive Path Matching in corydolphin/flask-cors

Priority HIGH 66CWE-178Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0072 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed flask-cors (PyPI): 6.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
corydolphincorydolphin/flask-corsup to latest—No fix listedCNA
—flask-cors (PyPI)before 6.0.06.0.0Patch availableGHSA-43qf-4rqw-9q2g
  • corydolphin/flask-cors Vendorcorydolphin Affected up to latest Fixed in — No fix listed CNA
  • flask-cors (PyPI) Vendor— Affected before 6.0.0 Fixed in 6.0.0 Patch available GHSA-43qf-4rqw-9q2g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:flask-cors_project:flask-cors:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableFlask-cors Project
  • cpe:2.3:a:flask-cors_project:flask-cors:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Flask-cors Project

Remediation

  • Fix · GHSA-43qf-4rqw-9q2g flask-cors (PyPI) Fixed in 6.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6866
  2. 2026-10-03 Alias added: GHSA-43qf-4rqw-9q2g

References

Exploit 1

Advisory 1

Other 4

  • TI-2024-05769 Improper Access Control in corydolphin/flask-cors CVSS 3.1HIGH 7.5
  • TI-2024-06346 Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors CVSS 3.0MEDIUM 5.3
  • TI-2024-01562 Log Injection Vulnerability in corydolphin/flask-cors CVSS 3.1MEDIUM 5.3
  • TI-2024-06341 Improper Regex Path Matching in corydolphin/flask-cors CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences