CVE-2026-37737

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-37737
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-37737.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-37737
Aliases
Published
2026-06-05T00:00:00Z
Modified
2026-10-21T02:30:17Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, to gain unauthorized access to cross-origin requests for authenticated resources.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37737.json"
}
References

Affected packages

Git / github.com/ashleysommer/sanic-cors

Affected ranges

Type
GIT
Repo
https://github.com/ashleysommer/sanic-cors
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
e0a7ab17a6d6e4dae72aa0ce754c0d3527a100cb
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "2.2.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

0.*
0.10.0
0.10.0.b1
0.10.0.post1
0.10.0.post2
0.10.0.post3
0.4.1
0.4.1.2
0.4.1.4
0.5.1.0
0.5.4.0
0.5.4.1
0.5.4.2
0.6.0.0
0.6.0.1
0.6.0.2
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.8.post1
0.9.8.post2
0.9.8.post3
0.9.9
0.9.9.post1
0.9.9.post2
0.9.9.post3
0.9.9.post4
1.*
1.0.0
1.0.1
2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.2.0b1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-37737.json"