requests (PyPI)
A simple, yet elegant, HTTP library.
Advisories
19
Latest version
2.34.2
Released May 14, 2026
License
Apache-2.0
OpenSSF Scorecard
8.2 / 10
How to fix
Upgrading to 2.33.0 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "requests>=2.34.2"poetry
poetry add "requests>=2.34.2"uv
uv add "requests>=2.34.2"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-gc5v-m9x4-r6x2 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function |
Medium EPSS 0.19% |
< 2.33.0 | 2.33.0 |
| GHSA-gc5v-m9x4-r6x2 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function |
Medium EPSS 0.19% |
< 2.33.0 | 2.33.0 |
| GHSA-gc5v-m9x4-r6x2 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function |
Medium EPSS 0.19% |
< 2.33.0 | 2.33.0 |
| GHSA-9hjg-9r4m-mvj7 Requests vulnerable to .netrc credentials leak via malicious URLs |
Medium EPSS 0.98% |
< 2.32.4 | 2.32.4 |
| GHSA-9hjg-9r4m-mvj7 Requests vulnerable to .netrc credentials leak via malicious URLs |
Medium EPSS 0.98% |
< 2.32.4 | 2.32.4 |
| GHSA-9hjg-9r4m-mvj7 Requests vulnerable to .netrc credentials leak via malicious URLs |
Medium EPSS 0.98% |
< 2.32.4 | 2.32.4 |
| GHSA-9wx4-h78v-vm56 Requests `Session` object does not verify requests after making first request with verify=False |
Medium EPSS 0.34% |
< 2.32.0 | 2.32.0 |
| GHSA-9wx4-h78v-vm56 Requests `Session` object does not verify requests after making first request with verify=False |
Medium EPSS 0.34% |
< 2.32.0 | 2.32.0 |
| GHSA-9wx4-h78v-vm56 Requests `Session` object does not verify requests after making first request with verify=False |
Medium EPSS 0.34% |
< 2.32.0 | 2.32.0 |
| GHSA-j8r2-6x86-q33q Unintended leak of Proxy-Authorization header in requests |
Medium EPSS 2.97% |
>= 2.3.0, < 2.31.0 | 2.31.0 |
| GHSA-j8r2-6x86-q33q Unintended leak of Proxy-Authorization header in requests |
Medium EPSS 2.97% |
>= 2.3.0, < 2.31.0 | 2.31.0 |
| GHSA-x84v-xcm2-53pg Insufficiently Protected Credentials in Requests |
High EPSS 6.93% |
< 2.20.0 | 2.20.0 |
| GHSA-x84v-xcm2-53pg Insufficiently Protected Credentials in Requests |
High EPSS 6.93% |
< 2.20.0 | 2.20.0 |
| GHSA-pg2w-x9wp-vw92 Python Requests Session Fixation |
Medium EPSS 3.18% |
>= 2.1.0, < 2.6.0 | 2.6.0 |
| GHSA-pg2w-x9wp-vw92 Python Requests Session Fixation |
Medium EPSS 3.18% |
>= 2.1.0, < 2.6.0 | 2.6.0 |
| GHSA-cfj3-7x9c-4p3h Exposure of Sensitive Information to an Unauthorized Actor in Requests |
Medium EPSS 2.20% |
< 2.3.0 | 2.3.0 |
| GHSA-cfj3-7x9c-4p3h Exposure of Sensitive Information to an Unauthorized Actor in Requests |
Medium EPSS 2.20% |
< 2.3.0 | 2.3.0 |
| GHSA-652x-xj99-gmcc Exposure of Sensitive Information to an Unauthorized Actor in Requests |
Medium EPSS 2.04% |
< 2.3.0 | 2.3.0 |
| GHSA-652x-xj99-gmcc Exposure of Sensitive Information to an Unauthorized Actor in Requests |
Medium EPSS 2.04% |
< 2.3.0 | 2.3.0 |
Source: https://github.com/psf/requests
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor