All vulnerabilities
CVE-2024-47081GHSA-9hjg-9r4m-mvj7PYSEC-2026-1872

Requests vulnerable to .netrc credentials leak via malicious URLs

psf requestspipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.98%Chance of exploitation activity in the next 30 days, higher than 61% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.32.4Fixed versionGitHub
Published9 Jun 2025Updated 19 Oct 2026CVE List

What fixes it

  • 2.32.4requests, pipGitHub
  • 2.32.4requests, PyPIOSVpip install "requests>=2.32.4"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2

Text from GitHub Advisory Database

Affected versions 53

  • requests, pip< 2.32.4GitHub
  • requestsaffected: < 2.32.4CVE List
  • requests, PyPIfrom first release, fixed in 2.32.4OSV
  • requests, PyPI0.0.1OSV
  • requests, PyPI0.10.0OSV
  • requests, PyPI0.10.1OSV
  • requests, PyPI0.10.2OSV
  • requests, PyPI0.10.3OSV
  • requests, PyPI0.10.4OSV
  • requests, PyPI0.10.6OSV
  • requests, PyPI0.10.7OSV
  • requests, PyPI0.10.8OSV
  • requests, PyPI0.11.1OSV
  • requests, PyPI0.11.2OSV
  • requests, PyPI0.12.0OSV
  • requests, PyPI0.12.01OSV
  • requests, PyPI0.12.1OSV
  • requests, PyPI0.13.0OSV
  • requests, PyPI0.13.1OSV
  • requests, PyPI0.13.2OSV
  • requests, PyPI0.13.3OSV
  • requests, PyPI0.13.4OSV
  • requests, PyPI0.13.5OSV
  • requests, PyPI0.13.6OSV
  • requests, PyPI0.13.7OSV
  • requests, PyPI0.13.8OSV
  • requests, PyPI0.13.9OSV
  • requests, PyPI0.14.0OSV
  • requests, PyPI0.14.1OSV
  • requests, PyPI0.14.2OSV
  • requests, PyPI0.2.0OSV
  • requests, PyPI0.2.1OSV
  • requests, PyPI0.2.2OSV
  • requests, PyPI0.2.3OSV
  • requests, PyPI0.2.4OSV
  • requests, PyPI0.3.0OSV
  • requests, PyPI0.3.1OSV
  • requests, PyPI0.3.2OSV
  • requests, PyPI0.3.3OSV
  • requests, PyPI0.3.4OSV
  • requests, PyPI0.4.0OSV
  • requests, PyPI0.4.1OSV
  • requests, PyPI0.5.0OSV
  • requests, PyPI0.5.1OSV
  • requests, PyPI0.6.0OSV
  • requests, PyPI0.6.1OSV
  • requests, PyPI0.6.2OSV
  • requests, PyPI0.6.3OSV
  • requests, PyPI0.6.4OSV
  • requests, PyPI0.6.5OSV
  • requests, PyPI0.6.6OSV
  • requests, PyPI0.7.0OSV
  • requests, PyPI0.7.1OSV

References 11