logo

Database

Sensitive information sent insecurely In requests

Description

Requests vulnerable to .netrc credentials leak via malicious URLs

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 23

10

Aliases

1. CVE-2024-470812. NVD-2024-470813. OSV-ALPINE-2024-470814. OSV-2024-470815. OSV-DEBIAN-2024-470816. GHSA-9hjg-9r4m-mvj77. GCVE-2024-470818. SECURITY-CVE-2024-470819. SECURITY-TRACKER-CVE-2024-47081

References

1. https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj72. https://github.com/psf/requests/pull/69653. https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef4. https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env5. https://seclists.org/fulldisclosure/2025/Jun/26. http://seclists.org/fulldisclosure/2025/Jun/27. http://www.openwall.com/lists/oss-security/2025/06/03/118. http://www.openwall.com/lists/oss-security/2025/06/03/99. http://www.openwall.com/lists/oss-security/2025/06/04/110. http://www.openwall.com/lists/oss-security/2025/06/04/6

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.