---
id: CVE-2024-6844
aliases:
  - GHSA-8vgw-p6qm-5gr7
  - PYSEC-2026-1385
title: Flask-CORS allows for inconsistent CORS matching
summary: Flask-CORS allows for inconsistent CORS matching
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: flask-cors
product: flask-cors
ecosystem: pip
affected:
  - flask-cors < 6.0.0
patched:
  - flask-cors 6.0.0
published: '2025-03-20'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:23.027959228Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8vgw-p6qm-5gr7'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-6844'
  - url: >-
      https://github.com/corydolphin/flask-cors/commit/35d875319621bd129a38b2b823abf4a2f6cda536
  - url: 'https://github.com/corydolphin/flask-cors'
  - url: >-
      https://github.com/corydolphin/flask-cors/blob/main/flask_cors/extension.py#L193
  - url: 'https://huntr.com/bounties/731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0'
  - url: 'https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html'
tags:
  - osv
  - pip
epss: 0.00313
epssPercentile: 0.24462
ingestedAt: '2026-07-08T18:25:47.550Z'
---

## Overview

A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.

## Affected packages

- `flask-cors < 6.0.0`

## Remediation

Upgrade to a patched release:

- `flask-cors 6.0.0`