CVE-2024-6866 - CVE House
Back to Database
Status published Medium CVE-2024-6866

Case-Insensitive Path Matching in corydolphin/flask-cors

Vulnerability Description

corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6866

Credits & Attribution

No credits recorded in the NVD database.

References

More from corydolphin

View All →
CVE-2024-6844
Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors
Medium 5.3
CVE-2024-6839
Improper Regex Path Matching in corydolphin/flask-cors
Medium 4.3
CVE-2024-6221
Improper Access Control in corydolphin/flask-cors
Medium 6.5
CVE-2024-1681
Log Injection Vulnerability in corydolphin/flask-cors
Medium 5.3

Affected Vendor

corydolphin

View all reports →

Affected Software

corydolphin/flask-cors
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-178

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.