StackRadar

CVE-2024-6839

Medium

Advisory

Published 20 Mar 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.3
base score, highest
EPSS
0.007
52nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
38
of 17,781 indexed, latest versions
Container images
43
deployed by those charts
Fix available
1 of 1
affected package

Flask-CORS improper regex path matching vulnerability

Carried by container images the latest versions of 38 of 17,781 indexed charts deploy, on 43 images.

Affected packageAffected versionsFixed inImages
flask-corspypi3.0.3, 3.0.8, 3.0.9, 3.0.10+5 more6.0.043
OSV records
GHSA-7rxf-gvfg-47g4
Also known as
PYSEC-2026-1384

Charts affected

38 by stars
ChartLatestAffected imagesRadar Score
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
flask-cors@5.0.0
6.0.0

Open the chart page →

10,622
locustdeliveryheroVerified publisher0.35.01 of 1See more

locust deliveryhero 0.35.0

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
locustio/locust:2.32.2a0d4b88e42c1
flask-cors@5.0.0
6.0.0

Open the chart page →

2,800
supersetcloudposse1.2.01 of 1See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
flask-cors@3.0.3
6.0.0

Open the chart page →

5,851
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
flask-cors@3.0.3
6.0.0

Open the chart page →

52,919
kubeflowkubeflow1.6.24 of 45See more

kubeflow kubeflow 1.6.2

4 of the 45 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
kserve/models-web-app:v0.8.063ea05e73842
flask-cors@3.0.10
6.0.0
kubeflownotebookswg/jupyter-web-app:v1.6.1d762690e21c1
flask-cors@3.0.10
6.0.0
kubeflownotebookswg/tensorboards-web-app:v1.6.10876fef1973b
flask-cors@3.0.10
6.0.0
kubeflownotebookswg/volumes-web-app:v1.6.17299fa94db15
flask-cors@3.0.10
6.0.0

Open the chart page →

96,941
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
flask-cors@5.0.0
6.0.0

Open the chart page →

3,569
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
flask-cors@3.0.10
6.0.0

Open the chart page →

7,129
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
flask-cors@4.0.1
6.0.0

Open the chart page →

20,403
locustlocustVerified publisher0.1.41 of 1See more

locust locust 0.1.4

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
hansehe/locust:1.1.0bc8e45262bc4
flask-cors@5.0.1
6.0.0

Open the chart page →

2,757
alertasomeblackmagic0.2.31 of 2See more

alerta someblackmagic 0.2.3

1 of the 2 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
alerta/alerta-web:8.5.04786b9eaa606
flask-cors@3.0.10
6.0.0

Open the chart page →

3,162
suggestarrcharliecharts0.4.41 of 1See more

suggestarr charliecharts 0.4.4

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
ciuse99/suggestarr:v1.0.20d72768245ef5
flask-cors@5.0.0
6.0.0

Open the chart page →

1,126
supersetcloudnativeapp1.1.61 of 1See more

superset cloudnativeapp 1.1.6

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
amancevice/superset:0.28.1c8c04bfe3d66
flask-cors@3.0.3
6.0.0

Open the chart page →

5,060
kfservingcowboysysopVerified publisher1.3.11 of 3See more

kfserving cowboysysop 1.3.1

1 of the 3 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
kfserving/models-web-app:v0.6.1f322d6ffdfa3
flask-cors@3.0.10
6.0.0

Open the chart page →

3,830
restcubedatacube-charts0.2.91 of 1See more

restcube datacube-charts 0.2.9

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
opendatacube/restcube:latest91870111837c
flask-cors@3.0.8
6.0.0

Open the chart page →

24,335
kube-openid-connectdevopstalesVerified publisher1.1.01 of 1See more

kube-openid-connect devopstales 1.1.0

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
devopstales/kube-openid-connector:1.042c40a0e9f1b
flask-cors@3.0.10
6.0.0

Open the chart page →

1,333
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
flask-cors@4.0.2
6.0.0

Open the chart page →

19,224
amundsenduyet1.1.02 of 7See more

amundsen duyet 1.1.0

2 of the 7 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
amundsendev/amundsen-metadata:2.5.44d98eb21f5f9
flask-cors@3.0.8
6.0.0
amundsendev/amundsen-search:2.4.099dda9502c3e
flask-cors@3.0.8
6.0.0

Open the chart page →

11,174
findery-marketfindery-market0.1.01 of 7See more

findery-market findery-market 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
chandanteekinavar/findery-market-product-service:1.0c49ff7c141c0
flask-cors@3.0.10
6.0.0

Open the chart page →

7,691
spectergaloymoney0.3.11 of 1See more

specter galoymoney 0.3.1

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
lncm/specter-desktop:v1.10.536eaa06f99f4
flask-cors@3.0.10
6.0.0

Open the chart page →

1,691
spectergaloymoney20.3.11 of 1See more

specter galoymoney2 0.3.1

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
lncm/specter-desktop:v1.10.536eaa06f99f4
flask-cors@3.0.10
6.0.0

Open the chart page →

1,691
ihatemoneygeek-cookbookVerified publisher1.1.21 of 1See more

ihatemoney geek-cookbook 1.1.2

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
ihatemoney/ihatemoney:5.2.0457fda1feb32
flask-cors@3.0.10
6.0.0

Open the chart page →

1,526
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
flask-cors@4.0.0
6.0.0

Open the chart page →

49,025
locusthelm-charts-nr0.32.41 of 1See more

locust helm-charts-nr 0.32.4

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
locustio/locust:2.32.2a0d4b88e42c1
flask-cors@5.0.0
6.0.0

Open the chart page →

2,800
itm-servicesintelVerified publisher2.0.01 of 8See more

itm-services intel 2.0.0

1 of the 8 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
flask-cors@3.0.10
6.0.0

Open the chart page →

18,066
bazarrk8s-home-lab-repo11.3.21 of 1See more

bazarr k8s-home-lab-repo 11.3.2

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
flask-cors@5.0.0
6.0.0

Open the chart page →

1,794
kubeflowkromanow94-kubeflow0.5.14 of 30See more

kubeflow kromanow94-kubeflow 0.5.1

4 of the 30 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
kserve/models-web-app:v0.13.073486345a602
flask-cors@4.0.1
6.0.0
kubeflownotebookswg/jupyter-web-app:v1.9.2afb52057c997
flask-cors@5.0.0
6.0.0
kubeflownotebookswg/tensorboards-web-app:v1.9.277f07f52a84a
flask-cors@5.0.0
6.0.0
kubeflownotebookswg/volumes-web-app:v1.9.2f63c3e550af3
flask-cors@5.0.0
6.0.0

Open the chart page →

70,530
specter-desktopkronkltdVerified publisher0.1.01 of 1See more

specter-desktop kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
lncm/specter-desktop:v0.10.4bca14d04397d
flask-cors@3.0.8
6.0.0

Open the chart page →

1,850
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
flask-cors@3.0.10
6.0.0

Open the chart page →

2,765
weather-app-chartlocal-weatherapp0.1.01 of 4See more

weather-app-chart local-weatherapp 0.1.0

1 of the 4 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
youssef11gaber10/deployment-weather-flask:latest96bce8b8b5a7
flask-cors@3.0.10
6.0.0

Open the chart page →

5,905
locust-pluginslocust-pluginsVerified publisher0.0.41 of 3See more

locust-plugins locust-plugins 0.0.4

1 of the 3 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
locustio/locust:2.24.151d866285170
flask-cors@4.0.0
6.0.0

Open the chart page →

7,510
parent-chartmid-proje0.1.01 of 3See more

parent-chart mid-proje 0.1.0

1 of the 3 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
youssef11gaber10/flask-service:latest9c727fcfde76
flask-cors@4.0.0
6.0.0

Open the chart page →

1,773
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
mintproject/data-catalog:9be70359feabe03ed55bfdbf92c20a7e43ab928b67d2f2103085
flask-cors@3.0.10
6.0.0

Open the chart page →

43,341
reportportalreportportal5.7.22 of 8See more

reportportal reportportal 5.7.2

2 of the 8 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
reportportal/service-auto-analyzer:5.7.295ada4a216ce
flask-cors@3.0.9
6.0.0
reportportal/service-metrics-gatherer:1.1.202a0e6dc11161
flask-cors@3.0.8
6.0.0

Open the chart page →

25,737
seldon-deployseldon1.4.01 of 2See more

seldon-deploy seldon 1.4.0

1 of the 2 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
seldonio/seldon-request-logger:1.11.24e985d2006a8
flask-cors@3.0.10
6.0.0

Open the chart page →

21,997
classificationsignalen4.24.01 of 1See more

classification signalen 4.24.0

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
signalen/classification:ad60447d1733473e30ab0a3ba53d58141cc1d2509496ae672877
flask-cors@3.0.8
6.0.0

Open the chart page →

1,553
demo-backendv2flyVerified publisher0.0.31 of 1See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
flask-cors@4.0.0
6.0.0

Open the chart page →

14,358
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
flask-cors@3.0.10
6.0.0

Open the chart page →

7,085
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2024-6839.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
flask-cors@5.0.0
6.0.0

Open the chart page →

13,677

Container images carrying it

43 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
amancevice/superset:0.35.212a0a9e66550
flask-cors@3.0.3
6.0.0
2
lncm/specter-desktop:v1.10.536eaa06f99f4
flask-cors@3.0.10
6.0.0
2
locustio/locust:2.32.2a0d4b88e42c1
flask-cors@5.0.0
6.0.0
2
alerta/alerta-web:8.5.04786b9eaa606
flask-cors@3.0.10
6.0.0
1
allegroai/clearml:2.0.0-613713ae38f7daf
flask-cors@5.0.0
6.0.0
1
amancevice/superset:0.28.1c8c04bfe3d66
flask-cors@3.0.3
6.0.0
1
amundsendev/amundsen-metadata:2.5.44d98eb21f5f9
flask-cors@3.0.8
6.0.0
1
amundsendev/amundsen-search:2.4.099dda9502c3e
flask-cors@3.0.8
6.0.0
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
flask-cors@3.0.10
6.0.0
1
apache/superset:4.0.1ab9467fd712c
flask-cors@3.0.10
6.0.0
1
chandanteekinavar/findery-market-product-service:1.0c49ff7c141c0
flask-cors@3.0.10
6.0.0
1
ciuse99/suggestarr:v1.0.20d72768245ef5
flask-cors@5.0.0
6.0.0
1
devopstales/kube-openid-connector:1.042c40a0e9f1b
flask-cors@3.0.10
6.0.0
1
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
flask-cors@5.0.0
6.0.0
1
hansehe/locust:1.1.0bc8e45262bc4
flask-cors@5.0.1
6.0.0
1
hayk96/alerta-web:9.0.486377705e9e3
flask-cors@5.0.0
6.0.0
1
ihatemoney/ihatemoney:5.2.0457fda1feb32
flask-cors@3.0.10
6.0.0
1
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
flask-cors@3.0.10
6.0.0
1
kfserving/models-web-app:v0.6.1f322d6ffdfa3
flask-cors@3.0.10
6.0.0
1
kserve/models-web-app:v0.8.063ea05e73842
flask-cors@3.0.10
6.0.0
1
kserve/models-web-app:v0.13.073486345a602
flask-cors@4.0.1
6.0.0
1
kubeflownotebookswg/jupyter-web-app:v1.9.2afb52057c997
flask-cors@5.0.0
6.0.0
1
kubeflownotebookswg/jupyter-web-app:v1.6.1d762690e21c1
flask-cors@3.0.10
6.0.0
1
kubeflownotebookswg/tensorboards-web-app:v1.6.10876fef1973b
flask-cors@3.0.10
6.0.0
1
kubeflownotebookswg/tensorboards-web-app:v1.9.277f07f52a84a
flask-cors@5.0.0
6.0.0
1
kubeflownotebookswg/volumes-web-app:v1.6.17299fa94db15
flask-cors@3.0.10
6.0.0
1
kubeflownotebookswg/volumes-web-app:v1.9.2f63c3e550af3
flask-cors@5.0.0
6.0.0
1
kyso/kyso-nbdime:latest4aa9d38ee81d
flask-cors@3.0.10
6.0.0
1
langgenius/dify-api:1.0.0066035f93856
flask-cors@4.0.2
6.0.0
1
langgenius/dify-api:0.6.11fca918260dd6
flask-cors@4.0.1
6.0.0
1
lncm/specter-desktop:v0.10.4bca14d04397d
flask-cors@3.0.8
6.0.0
1
locustio/locust:2.24.151d866285170
flask-cors@4.0.0
6.0.0
1
mintproject/data-catalog:9be70359feabe03ed55bfdbf92c20a7e43ab928b67d2f2103085
flask-cors@3.0.10
6.0.0
1
opendatacube/restcube:latest91870111837c
flask-cors@3.0.8
6.0.0
1
reportportal/service-auto-analyzer:5.7.295ada4a216ce
flask-cors@3.0.9
6.0.0
1
reportportal/service-metrics-gatherer:1.1.202a0e6dc11161
flask-cors@3.0.8
6.0.0
1
seldonio/seldon-request-logger:1.11.24e985d2006a8
flask-cors@3.0.10
6.0.0
1
signalen/classification:ad60447d1733473e30ab0a3ba53d58141cc1d2509496ae672877
flask-cors@3.0.8
6.0.0
1
youssef11gaber10/deployment-weather-flask:latest96bce8b8b5a7
flask-cors@3.0.10
6.0.0
1
youssef11gaber10/flask-service:latest9c727fcfde76
flask-cors@4.0.0
6.0.0
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
flask-cors@5.0.0
6.0.0
1
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
flask-cors@4.0.0
6.0.0
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
flask-cors@4.0.0
6.0.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.