{"schema":"threatline.record/2","record":{"id":"CVE-2024-47081","aliases":["GHSA-9hjg-9r4m-mvj7","PYSEC-2026-1872"],"summary":"Requests vulnerable to .netrc credentials leak via malicious URLs","details":"### Impact\n\nDue to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.\n\n### Workarounds\nFor older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).\n\n### References\nhttps://github.com/psf/requests/pull/6965\nhttps://seclists.org/fulldisclosure/2025/Jun/2","categories":["Libraries & packages"],"product":"requests","vendor":"psf","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7","source_modified_at":"2026-10-19T19:51:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"requests"},"range":"< 2.32.4"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-47081","source_modified_at":"2025-06-09T18:40:40.996Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"requests","vendor":"psf","versions":[{"status":"affected","version":"< 2.32.4"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7","source_modified_at":"2026-10-19T20:00:04.716114530Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"requests","ecosystem":"PyPI","purl":"pkg:pypi/requests"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.4"}]}],"versions":["0.0.1","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.6","0.10.7","0.10.8","0.11.1","0.11.2","0.12.0","0.12.01","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.13.9","0.14.0","0.14.1","0.14.2","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.7.0","0.7.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7","source_modified_at":"2026-10-19T19:51:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"requests"},"version":"2.32.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7","source_modified_at":"2026-10-19T20:00:04.716114530Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"requests","ecosystem":"PyPI","purl":"pkg:pypi/requests"},"version":"2.32.4"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0098,"percentile":0.61881,"score_date":"2026-10-23"},"published_at":"2025-06-09T17:57:47.731Z","modified_at":"2026-10-19T20:00:04.716114530Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-19T19:51:00Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-47081","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2025-06-09T18:40:40.996Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-19T20:00:04.716114530Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-47081","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/psf/requests/pull/6965","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://seclists.org/fulldisclosure/2025/Jun/2","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7","source":"GitHub Advisory Database"},{"url":"https://github.com/psf/requests","source":"GitHub Advisory Database"},{"url":"https://github.com/psf/requests/releases/tag/v2.32.4","source":"GitHub Advisory Database"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2026-1872.yaml","source":"GitHub Advisory Database"},{"url":"https://pypi.org/project/requests","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2025-06-09T18:39:03.849116Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T20:00:04.716114530Z","content_hash":"8330e74489b4d9caf504686c68dab4e91f1072559bb00cde2398657d370e6590"}}