CVE-2023-32681
published 2023-05-26CVE-2023-32681: Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS…
PriorityP433medium6.1CVSS 3.1
AVNACHPRNUIRSCCHINAN
EPSS
2.97%
85.7th percentile
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | requests | < requests 2.31.0+dfsg-1 (forky) | requests 2.31.0+dfsg-1 (forky) |
| fedoraproject | fedora | — | — |
| msrc | cbl2_python-requests_2.27.1-6_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_python-requests_2.22.0-3_on_cbl_mariner_1.0 | — | — |
| psf | requests | — | — |
| python | requests | >= 0 < 2.31.0+dfsg-1 | 2.31.0+dfsg-1 |
| python | requests | >= 0 < 2.31.0+dfsg-1 | 2.31.0+dfsg-1 |
| python | requests | >= 0 < 2.25.1+dfsg-2ubuntu0.3 | 2.25.1+dfsg-2ubuntu0.3 |
| python | requests | >= 0 < 2.31.0+dfsg-1ubuntu1.1 | 2.31.0+dfsg-1ubuntu1.1 |
| python | requests | >= 0 < 2.2.1-1ubuntu0.4+esm1 | 2.2.1-1ubuntu0.4+esm1 |
| python | requests | >= 0 < 2.9.1-3ubuntu0.1+esm2 | 2.9.1-3ubuntu0.1+esm2 |
| python | requests | >= 0 < 2.18.4-2ubuntu0.1+esm2 | 2.18.4-2ubuntu0.1+esm2 |
| python | requests | >= 0 < 2.22.0-2ubuntu1.1+esm1 | 2.22.0-2ubuntu1.1+esm1 |
| python | requests | >= 2.3.0 < 2.31.0 | 2.31.0 |
| python | requests | >= 2.3.0 < 2.31.0 | 2.31.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_msrc6.1MEDIUM
vendor_redhat6.1MEDIUM
vendor_ubuntu6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-pip vulnerabilities
osv·2025-09-23·CVSS 6.1
CVE-2023-32681 [MEDIUM] python-pip vulnerabilities
python-pip vulnerabilities
Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly
leaked Proxy-Authorization headers. A remote attacker could possibly use
this issue to obtain sensitive information. This update addresses the issue
in the Requests module bundled into pip in Ubuntu 22.04 LTS.
(CVE-2023-32681)
It was discovered that urllib3 didn't strip HTTP body on status code
303 redirects under certain circumstances. A remote attacker could
possibly use this issue to obtain sensitive information. This update
addresses the issue in the urllib3 module bundled into pip in Ubuntu
24.04 LTS. (CVE-2023-45803)
Guido Vranken discovered that idna did not properly manage certain inputs,
which could lead to significant resource consumption. An attacker could
possibly use this issue
OSV
requests vulnerabilities
osv·2025-06-16·CVSS 6.1
CVE-2023-32681 [MEDIUM] requests vulnerabilities
requests vulnerabilities
Dennis Brinkrolf and Tobias Funke discovered that Requests did not
correctly handle certain HTTP headers. A remote attacker could possibly
use this issue to leak sensitive information. This issue only affected
Ubuntu 14.04 LTS. (CVE-2023-32681)
Juho Forsén discovered that Requests did not correctly parse URLs. A
remote attacker could possibly use this issue to leak sensitive
information. (CVE-2024-47081)
OSV
CVE-2023-32681: Requests is a HTTP library
osv·2023-05-26·CVSS 6.1
CVE-2023-32681 [MEDIUM] CVE-2023-32681: Requests is a HTTP library
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in ve
GHSA
Unintended leak of Proxy-Authorization header in requests
ghsa·2023-05-22
CVE-2023-32681 [MEDIUM] CWE-200 Unintended leak of Proxy-Authorization header in requests
Unintended leak of Proxy-Authorization header in requests
### Impact
Since Requests v2.3.0, Requests has been vulnerable to potentially leaking `Proxy-Authorization` headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how `rebuild_proxies` is used to recompute and [reattach the `Proxy-Authorization` header](https://github.com/psf/requests/blob/f2629e9e3c7ce3c3c8c025bcd8db551101cbc773/requests/sessions.py#L319-L328) to requests when redirected. Note this behavior has _only_ been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. `https://username:password@proxy:8080`).
**Current vulnerable behavior(s):**
1. HTTP → HTTPS: **leak**
2. HTTPS → HTTP: **no leak**
3. HTTPS → HTTPS: **
OSV
Unintended leak of Proxy-Authorization header in requests
osv·2023-05-22
CVE-2023-32681 [MEDIUM] Unintended leak of Proxy-Authorization header in requests
Unintended leak of Proxy-Authorization header in requests
### Impact
Since Requests v2.3.0, Requests has been vulnerable to potentially leaking `Proxy-Authorization` headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how `rebuild_proxies` is used to recompute and [reattach the `Proxy-Authorization` header](https://github.com/psf/requests/blob/f2629e9e3c7ce3c3c8c025bcd8db551101cbc773/requests/sessions.py#L319-L328) to requests when redirected. Note this behavior has _only_ been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. `https://username:password@proxy:8080`).
**Current vulnerable behavior(s):**
1. HTTP → HTTPS: **leak**
2. HTTPS → HTTP: **no leak**
3. HTTPS → HTTPS: **
Ubuntu
pip vulnerabilities
vendor_ubuntu·2025-09-23·CVSS 6.1
CVE-2023-45803 [MEDIUM] pip vulnerabilities
Title: pip vulnerabilities
Summary: Several security issues were fixed in pip.
Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly
leaked Proxy-Authorization headers. A remote attacker could possibly use
this issue to obtain sensitive information. This update addresses the issue
in the Requests module bundled into pip in Ubuntu 22.04 LTS.
(CVE-2023-32681)
It was discovered that urllib3 didn't strip HTTP body on status code
303 redirects under certain circumstances. A remote attacker could
possibly use this issue to obtain sensitive information. This update
addresses the issue in the urllib3 module bundled into pip in Ubuntu
24.04 LTS. (CVE-2023-45803)
Guido Vranken discovered that idna did not properly manage certain inputs,
which could lead to significant resource c
Ubuntu
Requests vulnerabilities
vendor_ubuntu·2025-06-16·CVSS 6.1
CVE-2023-32681 [MEDIUM] Requests vulnerabilities
Title: Requests vulnerabilities
Summary: Several security issues were fixed in Requests.
Dennis Brinkrolf and Tobias Funke discovered that Requests did not
correctly handle certain HTTP headers. A remote attacker could possibly
use this issue to leak sensitive information. This issue only affected
Ubuntu 14.04 LTS. (CVE-2023-32681)
Juho Forsén discovered that Requests did not correctly parse URLs. A
remote attacker could possibly use this issue to leak sensitive
information. (CVE-2024-47081)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Requests vulnerability
vendor_ubuntu·2023-06-15
CVE-2023-32681 Requests vulnerability
Title: Requests vulnerability
Summary: Requests could be made to expose sensitive information over the network.
USN-6155-1 fixed a vulnerability in Requests. This update provides
the corresponding update for Ubuntu 16.04 ESM and 18.04 ESM.
Original advisory details:
Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly
leaked Proxy-Authorization headers. A remote attacker could possibly use
this issue to obtain sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Requests vulnerability
vendor_ubuntu·2023-06-12
CVE-2023-32681 Requests vulnerability
Title: Requests vulnerability
Summary: Requests could be made to expose sensitive information over the network.
Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly
leaked Proxy-Authorization headers. A remote attacker could possibly use
this issue to obtain sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-requests: Unintended leak of Proxy-Authorization header
vendor_redhat·2023-05-23·CVSS 6.1
CVE-2023-32681 [MEDIUM] CWE-402 python-requests: Unintended leak of Proxy-Authorization header
python-requests: Unintended leak of Proxy-Authorization header
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exf
Microsoft
Unintended leak of Proxy-Authorization header in requests
vendor_msrc·2023-05-09·CVSS 6.1
CVE-2023-32681 [MEDIUM] CWE-200 Unintended leak of Proxy-Authorization header in requests
Unintended leak of Proxy-Authorization header in requests
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https
Debian
CVE-2023-32681: requests - Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Prox...
vendor_debian·2023·CVSS 6.1
CVE-2023-32681 [MEDIUM] CVE-2023-32681: requests - Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Prox...
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in ve
No detection rules found.
No public exploits indexed.
https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5https://github.com/psf/requests/releases/tag/v2.31.0https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33qhttps://lists.debian.org/debian-lts-announce/2023/06/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/https://lists.fedoraproject.org/archives/list/[email protected]/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ/https://security.gentoo.org/glsa/202309-08https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5https://github.com/psf/requests/releases/tag/v2.31.0https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33qhttps://lists.debian.org/debian-lts-announce/2023/06/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/https://lists.fedoraproject.org/archives/list/[email protected]/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ/https://security.gentoo.org/glsa/202309-08
2023-05-26
Published