CVE-2024-47081 — Insufficiently Protected Credentials in Requests

CWE-522 — Insufficiently Protected Credentials11 documents8 sources
Severity
5.3MEDIUMNVD
OSV6.1
EPSS
0.2%
top 56.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PSF RequestsPython Requests
Timeline
PublishedJun 9
Latest updateSep 23

Description

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5psf/requests< 2.32.4
▶PyPIpython/requests< 2.32.4
▶Debianpython/requests< 2.32.3+dfsg-5+deb13u1+1
▶Ubuntupython/requests< 2.25.1+dfsg-2ubuntu0.3+5

🔴Vulnerability Details

5
OSV
requests vulnerabilities↗2025-06-16
▶
OSV
Requests vulnerable to .netrc credentials leak via malicious URLs↗2025-06-09
▶
CVEList
Requests vulnerable to .netrc credentials leak via malicious URLs↗2025-06-09
▶
OSV
CVE-2024-47081: Requests is a HTTP library↗2025-06-09
▶
GHSA
Requests vulnerable to .netrc credentials leak via malicious URLs↗2025-06-09
▶

📋Vendor Advisories

5
Ubuntu
pip vulnerabilities↗2025-09-23
▶
Ubuntu
Requests vulnerabilities↗2025-06-16
▶
Microsoft
Requests vulnerable to .netrc credentials leak via malicious URLs↗2025-06-10
▶
Red Hat
requests: Requests vulnerable to .netrc credentials leak via malicious URLs↗2025-06-09
▶
Debian
CVE-2024-47081: requests - Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior ...↗2024
▶
CVE-2024-47081 — Insufficiently Protected Credentials | cvebase