CVE-2023-32681 — Sensitive Information Exposure in Requests

CWE-200 — Sensitive Information ExposureCWE-402 — Resource Leak14 documents8 sources
Severity
6.1MEDIUMNVD
EPSS
6.1%
top 9.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Python RequestsPSF RequestsFedoraproject Fedora
Timeline
PublishedMay 26
Latest updateSep 23

Description

Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header …

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:NExploitability: 1.6 | Impact: 4.0

Affected Packages5 packages

▶NVDpython/requests2.3.0 — 2.31.0
▶PyPIpython/requests2.3.0 — 2.31.0
▶Debianpython/requests< 2.31.0+dfsg-1+1
▶Ubuntupython/requests< 2.25.1+dfsg-2ubuntu0.3+5
▶CVEListV5psf/requests>= 2.3.0, < 2.31.0

Also affects: Fedora 37

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

6
OSV
python-pip vulnerabilities↗2025-09-23
▶
OSV
requests vulnerabilities↗2025-06-16
▶
CVEList
Unintended leak of Proxy-Authorization header in requests↗2023-05-26
▶
OSV
CVE-2023-32681: Requests is a HTTP library↗2023-05-26
▶
GHSA
Unintended leak of Proxy-Authorization header in requests↗2023-05-22
▶

📋Vendor Advisories

7
Ubuntu
pip vulnerabilities↗2025-09-23
▶
Ubuntu
Requests vulnerabilities↗2025-06-16
▶
Ubuntu
Requests vulnerability↗2023-06-15
▶
Ubuntu
Requests vulnerability↗2023-06-12
▶
Red Hat
python-requests: Unintended leak of Proxy-Authorization header↗2023-05-23
▶
CVE-2023-32681 — Sensitive Information Exposure | cvebase