CVE-2024-6844 is a medium severity vulnerability in flask-cors versions prior to 6.0.0. It arises from inconsistent CORS matching due to the handling of the '+' character in URL paths, which is converted to a space by unquote_plus. This causes incorrect path normalization and potential mismatches in CORS policy application, possibly allowing unauthorized cross-origin access or blocking legitimate requests. A fix is available in version 6.0.0.