Vulnerability Description
corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flask-Cors Project | Flask-Cors | 4.0.1 |
Related Weaknesses (CWE)
References
- https://huntr.com/bounties/808c11af-faee-43a8-824b-b5ab4f62b9e6ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html
FAQ
What is CVE-2024-6866?
CVE-2024-6866 is a vulnerability with a CVSS score of 7.5 (HIGH). corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching h...
How severe is CVE-2024-6866?
CVE-2024-6866 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-6866?
Check the references section above for vendor advisories and patch information. Affected products include: Flask-Cors Project Flask-Cors.