CVE-2024-47081
published 2025-06-09CVE-2024-47081: Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific…
PriorityP428medium5.3CVSS 3.1
AVNACHPRNUIRSUCHINAN
EPSS
0.84%
53.8th percentile
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | requests | < requests 2.32.4+dfsg-1 (forky) | requests 2.32.4+dfsg-1 (forky) |
| msrc | azl3_python-requests_2.31.0-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python-requests_2.27.1-8_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-virtualenv_20.26.6-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm2_python-requests_2.27.1-8_on_cbl_mariner_2.0 | — | — |
| psf | requests | < 2.32.4 | 2.32.4 |
| python | requests | >= 0 < 2.32.3+dfsg-5+deb13u1 | 2.32.3+dfsg-5+deb13u1 |
| python | requests | >= 0 < 2.32.4+dfsg-1 | 2.32.4+dfsg-1 |
| python | requests | >= 0 < 2.32.4 | 2.32.4 |
| python | requests | >= 0 < 2.25.1+dfsg-2ubuntu0.3 | 2.25.1+dfsg-2ubuntu0.3 |
| python | requests | >= 0 < 2.31.0+dfsg-1ubuntu1.1 | 2.31.0+dfsg-1ubuntu1.1 |
| python | requests | >= 0 < 2.2.1-1ubuntu0.4+esm1 | 2.2.1-1ubuntu0.4+esm1 |
| python | requests | >= 0 < 2.9.1-3ubuntu0.1+esm2 | 2.9.1-3ubuntu0.1+esm2 |
| python | requests | >= 0 < 2.18.4-2ubuntu0.1+esm2 | 2.18.4-2ubuntu0.1+esm2 |
| python | requests | >= 0 < 2.22.0-2ubuntu1.1+esm1 | 2.22.0-2ubuntu1.1+esm1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
osv6.1MEDIUM
vendor_ubuntu6.1MEDIUM
vendor_debian5.3MEDIUM
vendor_msrc5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-pip vulnerabilities
osv·2025-09-23·CVSS 6.1
CVE-2023-32681 [MEDIUM] python-pip vulnerabilities
python-pip vulnerabilities
Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly
leaked Proxy-Authorization headers. A remote attacker could possibly use
this issue to obtain sensitive information. This update addresses the issue
in the Requests module bundled into pip in Ubuntu 22.04 LTS.
(CVE-2023-32681)
It was discovered that urllib3 didn't strip HTTP body on status code
303 redirects under certain circumstances. A remote attacker could
possibly use this issue to obtain sensitive information. This update
addresses the issue in the urllib3 module bundled into pip in Ubuntu
24.04 LTS. (CVE-2023-45803)
Guido Vranken discovered that idna did not properly manage certain inputs,
which could lead to significant resource consumption. An attacker could
possibly use this issue
OSV
requests vulnerabilities
osv·2025-06-16·CVSS 6.1
CVE-2023-32681 [MEDIUM] requests vulnerabilities
requests vulnerabilities
Dennis Brinkrolf and Tobias Funke discovered that Requests did not
correctly handle certain HTTP headers. A remote attacker could possibly
use this issue to leak sensitive information. This issue only affected
Ubuntu 14.04 LTS. (CVE-2023-32681)
Juho Forsén discovered that Requests did not correctly parse URLs. A
remote attacker could possibly use this issue to leak sensitive
information. (CVE-2024-47081)
OSV
Requests vulnerable to .netrc credentials leak via malicious URLs
osv·2025-06-09
CVE-2024-47081 [MEDIUM] Requests vulnerable to .netrc credentials leak via malicious URLs
Requests vulnerable to .netrc credentials leak via malicious URLs
### Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
### Workarounds
For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).
### References
https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2
OSV
CVE-2024-47081: Requests is a HTTP library
osv·2025-06-09·CVSS 5.3
CVE-2024-47081 [MEDIUM] CVE-2024-47081: Requests is a HTTP library
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
GHSA
Requests vulnerable to .netrc credentials leak via malicious URLs
ghsa·2025-06-09
CVE-2024-47081 [MEDIUM] CWE-522 Requests vulnerable to .netrc credentials leak via malicious URLs
Requests vulnerable to .netrc credentials leak via malicious URLs
### Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
### Workarounds
For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).
### References
https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2
Ubuntu
pip vulnerabilities
vendor_ubuntu·2025-09-23·CVSS 6.1
CVE-2023-45803 [MEDIUM] pip vulnerabilities
Title: pip vulnerabilities
Summary: Several security issues were fixed in pip.
Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly
leaked Proxy-Authorization headers. A remote attacker could possibly use
this issue to obtain sensitive information. This update addresses the issue
in the Requests module bundled into pip in Ubuntu 22.04 LTS.
(CVE-2023-32681)
It was discovered that urllib3 didn't strip HTTP body on status code
303 redirects under certain circumstances. A remote attacker could
possibly use this issue to obtain sensitive information. This update
addresses the issue in the urllib3 module bundled into pip in Ubuntu
24.04 LTS. (CVE-2023-45803)
Guido Vranken discovered that idna did not properly manage certain inputs,
which could lead to significant resource c
Ubuntu
Requests vulnerabilities
vendor_ubuntu·2025-06-16·CVSS 6.1
CVE-2023-32681 [MEDIUM] Requests vulnerabilities
Title: Requests vulnerabilities
Summary: Several security issues were fixed in Requests.
Dennis Brinkrolf and Tobias Funke discovered that Requests did not
correctly handle certain HTTP headers. A remote attacker could possibly
use this issue to leak sensitive information. This issue only affected
Ubuntu 14.04 LTS. (CVE-2023-32681)
Juho Forsén discovered that Requests did not correctly parse URLs. A
remote attacker could possibly use this issue to leak sensitive
information. (CVE-2024-47081)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Requests vulnerable to .netrc credentials leak via malicious URLs
vendor_msrc·2025-06-10·CVSS 5.3
CVE-2024-47081 [MEDIUM] CWE-522 Requests vulnerable to .netrc credentials leak via malicious URLs
Requests vulnerable to .netrc credentials leak via malicious URLs
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Referenc
Red Hat
requests: Requests vulnerable to .netrc credentials leak via malicious URLs
vendor_redhat·2025-06-09·CVSS 5.3
CVE-2024-47081 [MEDIUM] CWE-522 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
requests: Requests vulnerable to .netrc credentials leak via malicious URLs
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
A flaw was found in the Requests HTTP library. This vulnerability allows leakage of .netrc credentials to third parties via maliciously crafted URLs that exploit a URL parsing issue.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment,
Debian
CVE-2024-47081: requests - Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior ...
vendor_debian·2024·CVSS 5.3
CVE-2024-47081 [MEDIUM] CVE-2024-47081: requests - Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior ...
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.32.4+dfsg-1)
sid: resolved (fixed in 2.32.4+dfsg-1)
trixie: resolved (fixed in 2.32.3+dfsg-5+deb13u1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-47081 python-botocore: Requests vulnerable to .netrc credentials leak via malicious URLs [fedora-42]
bugzilla·2025-06-12·CVSS 5.3
CVE-2024-47081 [MEDIUM] CVE-2024-47081 python-botocore: Requests vulnerable to .netrc credentials leak via malicious URLs [fedora-42]
CVE-2024-47081 python-botocore: Requests vulnerable to .netrc credentials leak via malicious URLs [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2371272
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with
Bugzilla
CVE-2024-47081 python-botocore: Requests vulnerable to .netrc credentials leak via malicious URLs [epel-9]
bugzilla·2025-06-12·CVSS 5.3
CVE-2024-47081 [MEDIUM] CVE-2024-47081 python-botocore: Requests vulnerable to .netrc credentials leak via malicious URLs [epel-9]
CVE-2024-47081 python-botocore: Requests vulnerable to .netrc credentials leak via malicious URLs [epel-9]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2371272
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
Bugzilla
CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
bugzilla·2025-06-09·CVSS 5.3
CVE-2024-47081 [MEDIUM] CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:12519 https://access.redhat.com/errata/RHSA-2025:12519
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2025:13234 https://access.redhat.com/errata/RHSA-2025:13234
---
This issue has been
https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144efhttps://github.com/psf/requests/pull/6965https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_envhttps://seclists.org/fulldisclosure/2025/Jun/2http://seclists.org/fulldisclosure/2025/Jun/2http://www.openwall.com/lists/oss-security/2025/06/03/11http://www.openwall.com/lists/oss-security/2025/06/03/9http://www.openwall.com/lists/oss-security/2025/06/04/1http://www.openwall.com/lists/oss-security/2025/06/04/6
2025-06-09
Published