GHSA-9hjg-9r4m-mvj7 CVE-2024-47081 PYSEC-2026-1872
Requests vulnerable to .netrc credentials leak via malicious URLs
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.98%
- Chance of exploitation in the next 30 days. Higher than 62.22% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-522 Insufficiently Protected Credentials
- Fix
2.32.4- Upgrade requests to this version or later
Description
Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
Workarounds
For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).
References
https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2
Affected versions
PyPI
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
requests PyPI → 2.32.4
- pip
pip install --upgrade "requests>=2.32.4"- poetry
poetry add "requests>=2.32.4"- uv
uv add "requests>=2.32.4"
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How to prevent it
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
References
Advisories
Fixes and patches
Other links
- requests.readthedocs.io/en/latest/api
- seclists.org/fulldisclosure/2025/Jun/2
- openwall.com/lists/oss-security/2025/06/03/11
- openwall.com/lists/oss-security/2025/06/03/9
- openwall.com/lists/oss-security/2025/06/04/1
- openwall.com/lists/oss-security/2025/06/04/6
- github.com/psf/requests
- github.com/psf/requests/releases/tag/v2.32.4
- github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2026-1872.yaml
- pypi.org/project/requests
- seclists.org/fulldisclosure/2025/Jun/2
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-gc5v-m9x4-r6x2 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function | Medium | Also affects requests |
| GHSA-9wx4-h78v-vm56 Requests `Session` object does not verify requests after making first request with verify=False | Medium | Also affects requests |
| GHSA-j8r2-6x86-q33q Unintended leak of Proxy-Authorization header in requests | Medium | Also affects requests |
| GHSA-x84v-xcm2-53pg Insufficiently Protected Credentials in Requests | High | Also affects requests |
| GHSA-pg2w-x9wp-vw92 Python Requests Session Fixation | Medium | Also affects requests |
| GHSA-cfj3-7x9c-4p3h Exposure of Sensitive Information to an Unauthorized Actor in Requests | Medium | Also affects requests |
| GHSA-652x-xj99-gmcc Exposure of Sensitive Information to an Unauthorized Actor in Requests | Medium | Also affects requests |
| EEF-CVE-2026-113440 HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | Not rated yet | Same weakness, CWE-522 |
Credits: jupenur, nateprewitt, omerlevyk, sethmlarson, sigmavirus24
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor