Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-6866Case-Insensitive Path Matching in corydolphin/flask-cors
Medium 5.3
In plain English
A medium-severity security flaw in corydolphin/flask-cors from corydolphin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-flask-cors | 3.0.10-2+deb12u1 | DEBIAN-CVE-2024-6866 |
| Debian:13 | python-flask-cors | 6.0.0-1 | DEBIAN-CVE-2024-6866 |
| Debian:14 | python-flask-cors | 6.0.0-1 | DEBIAN-CVE-2024-6866 |
| PyPI | flask-cors | 6.0.0 | GHSA-43qf-4rqw-9q2g |
| PyPI | flask-cors | 6.0.0 | PYSEC-2026-1383 |
| Ubuntu:22.04:LTS | python-flask-cors | 3.0.9-2ubuntu0.1 | USN-7612-1 |
| Ubuntu:22.04:LTS | python-flask-cors | 3.0.9-2ubuntu0.1 | UBUNTU-CVE-2024-6866 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| corydolphin | corydolphin/flask-cors | unspecified – through latest |
Weakness: CWE-178 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N