{"id":"CVE-2024-6844","aliases":["GHSA-8vgw-p6qm-5gr7","PYSEC-2026-1385"],"title":"Flask-CORS allows for inconsistent CORS matching","summary":"Flask-CORS allows for inconsistent CORS matching","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"flask-cors","product":"flask-cors","ecosystem":"pip","affected":["flask-cors < 6.0.0"],"patched":["flask-cors 6.0.0"],"published":"2025-03-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:23.027959228Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8vgw-p6qm-5gr7","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6844"},{"url":"https://github.com/corydolphin/flask-cors/commit/35d875319621bd129a38b2b823abf4a2f6cda536"},{"url":"https://github.com/corydolphin/flask-cors"},{"url":"https://github.com/corydolphin/flask-cors/blob/main/flask_cors/extension.py#L193"},{"url":"https://huntr.com/bounties/731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html"}],"tags":["osv","pip"],"epss":0.00313,"epssPercentile":0.24462,"ingestedAt":"2026-07-08T18:25:47.550Z","slug":"CVE-2024-6844","body":"## Overview\n\nA vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.\n\n## Affected packages\n\n- `flask-cors < 6.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `flask-cors 6.0.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}