{
  "cveId": "CVE-2024-6839",
  "url": "https://patchblox.com/security/cve/CVE-2024-6839",
  "summary": "CVE-2024-6839 is fixed in 2 products on 1 platform, first by python3-flask-cors 3.0.8-2ubuntu0.1\u002Besm1, released March 20, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python3-flask-cors: corydolphin/flask-cors version 4.0.1 contains an improper regex pathmatching vulnerability",
  "description": "corydolphin/flask-cors version 4.0.1 contains an improper regex pathmatching vulnerability. The plugin prioritizes longer regex patterns overmore specific ones when matching paths, which can lead to less restrictiveCORS policies being applied to sensitive endpoints. This mismatch in regexpattern priority allows unauthorized cross-origin access to sensitive dataor functionality, potentially exposing confidential information andincreasing the risk of unauthorized actions by malicious actors.",
  "published": "2025-03-20T03:15:00Z",
  "severity": "Medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss": 0.0074,
  "epssPercentile": 0.54858,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-flask-cors",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.0.10-2\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2024-6839",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-6839",
      "released": "2025-03-20T10:15:33Z"
    },
    {
      "platform": "linux",
      "product": "python-flask-cors",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.1-1",
      "fix": "DEBIAN-CVE-2024-6839",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-6839",
      "released": "2025-03-20T10:15:33Z"
    },
    {
      "platform": "linux",
      "product": "python-flask-cors",
      "release": "Debian 14",
      "fixedVersion": "6.0.1-1",
      "fix": "DEBIAN-CVE-2024-6839",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-6839",
      "released": "2025-03-20T10:15:33Z"
    },
    {
      "platform": "linux",
      "product": "python3-flask-cors",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "3.0.8-2ubuntu0.1\u002Besm1",
      "fix": "python3-flask-cors 3.0.8-2ubuntu0.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-flask-cors-3.0.8-2ubuntu0.1-esm1",
      "released": "2025-03-20T03:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-flask-cors",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.0.9-2ubuntu0.1",
      "fix": "python3-flask-cors 3.0.9-2ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-flask-cors-3.0.9-2ubuntu0.1",
      "released": "2025-03-20T03:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-flask-cors",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "4.0.0-1ubuntu0.1~esm1",
      "fix": "python3-flask-cors 4.0.0-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-flask-cors-4.0.0-1ubuntu0.1-esm1",
      "released": "2025-03-20T03:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-flask-cors",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "4.0.1-1ubuntu0.1",
      "fix": "python3-flask-cors 4.0.1-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-python3-flask-cors-4.0.1-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "python3-flask-cors",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "5.0.0-1ubuntu0.1",
      "fix": "python3-flask-cors 5.0.0-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-python3-flask-cors-5.0.0-1ubuntu0.1",
      "released": "2026-01-16T01:42:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}