Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
Metrics
Affected Vendors & Products
References
History
Wed, 11 Jun 2025 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
References |
| |
Metrics |
threat_severity
|
threat_severity
|
Mon, 09 Jun 2025 19:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Mon, 09 Jun 2025 18:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
References |
|
Mon, 09 Jun 2025 18:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. | |
Title | Requests vulnerable to .netrc credentials leak via malicious URLs | |
Weaknesses | CWE-522 | |
References |
|
|
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: GitHub_M
Published: 2025-06-09T17:57:47.731Z
Updated: 2025-06-09T18:40:40.996Z
Reserved: 2024-09-17T17:42:37.030Z
Link: CVE-2024-47081

Updated: 2025-06-09T18:04:45.705Z

Status : Awaiting Analysis
Published: 2025-06-09T18:15:24.983
Modified: 2025-06-12T16:06:47.857
Link: CVE-2024-47081
