Description
Requests vulnerable to .netrc credentials leak via malicious URLs
Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
Workarounds
For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).
References
https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 alpine v3.19 | | =1.0.4-r0 || =1.1.0-r0 || =1.2.3-r0 || =2.0.0-r0 || =2.10.0-r0 || =2.11.0-r0 || =2.11.1-r0 || =2.11.1-r1 || =2.12.4-r0 || =2.12.4-r1 || =2.13.0-r0 || =2.16.5-r0 || =2.17.3-r0 || =2.18.1-r0 || =2.18.1-r1 || =2.18.2-r0 || =2.18.3-r0 || =2.18.4-r0 || =2.19.1-r0 || =2.21.0-r0 || =2.21.0-r1 || =2.21.0-r2 || =2.21.0-r3 || =2.21.0-r4 || =2.21.0-r5 || =2.21.0-r6 || =2.22.0-r0 || =2.22.0-r1 || =2.23.0-r0 || =2.24.0-r0 || =2.24.0-r1 || =2.24.0-r2 || =2.24.0-r3 || =2.25.0-r0 || =2.25.0-r1 || =2.25.1-r0 || =2.25.1-r1 || =2.25.1-r2 || =2.25.1-r3 || =2.25.1-r4 || =2.26.0-r0 || =2.26.0-r1 || =2.26.0-r2 || =2.27.1-r0 || =2.28.1-r0 || =2.28.1-r1 || =2.28.1-r2 || =2.28.2-r0 || =2.28.2-r1 || =2.29.0-r0 || =2.3.0-r0 || =2.30.0-r0 || =2.31.0-r0 || =2.31.0-r1 || =2.32.3-r0 || =2.4.3-r0 || =2.5.1-r0 || =2.5.2-r0 || =2.6.0-r0 || =2.7.0-r0 || =2.8.1-r0 || =2.9.1-r0 || >=0 <2.32.4-r0 | 2.32.4-r0 |
alpine v3.20 | | =1.0.4-r0 || =1.1.0-r0 || =1.2.3-r0 || =2.0.0-r0 || =2.10.0-r0 || =2.11.0-r0 || =2.11.1-r0 || =2.11.1-r1 || =2.12.4-r0 || =2.12.4-r1 || =2.13.0-r0 || =2.16.5-r0 || =2.17.3-r0 || =2.18.1-r0 || =2.18.1-r1 || =2.18.2-r0 || =2.18.3-r0 || =2.18.4-r0 || =2.19.1-r0 || =2.21.0-r0 || =2.21.0-r1 || =2.21.0-r2 || =2.21.0-r3 || =2.21.0-r4 || =2.21.0-r5 || =2.21.0-r6 || =2.22.0-r0 || =2.22.0-r1 || =2.23.0-r0 || =2.24.0-r0 || =2.24.0-r1 || =2.24.0-r2 || =2.24.0-r3 || =2.25.0-r0 || =2.25.0-r1 || =2.25.1-r0 || =2.25.1-r1 || =2.25.1-r2 || =2.25.1-r3 || =2.25.1-r4 || =2.26.0-r0 || =2.26.0-r1 || =2.26.0-r2 || =2.27.1-r0 || =2.28.1-r0 || =2.28.1-r1 || =2.28.1-r2 || =2.28.2-r0 || =2.28.2-r1 || =2.29.0-r0 || =2.3.0-r0 || =2.30.0-r0 || =2.31.0-r0 || =2.31.0-r1 || =2.31.0-r2 || =2.32.3-r0 || =2.4.3-r0 || =2.5.1-r0 || =2.5.2-r0 || =2.6.0-r0 || =2.7.0-r0 || =2.8.1-r0 || =2.9.1-r0 || >=0 <2.32.4-r0 | 2.32.4-r0 |
alpine v3.21 | | =1.0.4-r0 || =1.1.0-r0 || =1.2.3-r0 || =2.0.0-r0 || =2.10.0-r0 || =2.11.0-r0 || =2.11.1-r0 || =2.11.1-r1 || =2.12.4-r0 || =2.12.4-r1 || =2.13.0-r0 || =2.16.5-r0 || =2.17.3-r0 || =2.18.1-r0 || =2.18.1-r1 || =2.18.2-r0 || =2.18.3-r0 || =2.18.4-r0 || =2.19.1-r0 || =2.21.0-r0 || =2.21.0-r1 || =2.21.0-r2 || =2.21.0-r3 || =2.21.0-r4 || =2.21.0-r5 || =2.21.0-r6 || =2.22.0-r0 || =2.22.0-r1 || =2.23.0-r0 || =2.24.0-r0 || =2.24.0-r1 || =2.24.0-r2 || =2.24.0-r3 || =2.25.0-r0 || =2.25.0-r1 || =2.25.1-r0 || =2.25.1-r1 || =2.25.1-r2 || =2.25.1-r3 || =2.25.1-r4 || =2.26.0-r0 || =2.26.0-r1 || =2.26.0-r2 || =2.27.1-r0 || =2.28.1-r0 || =2.28.1-r1 || =2.28.1-r2 || =2.28.2-r0 || =2.28.2-r1 || =2.29.0-r0 || =2.3.0-r0 || =2.30.0-r0 || =2.31.0-r0 || =2.31.0-r1 || =2.31.0-r2 || =2.32.2-r0 || =2.32.3-r0 || =2.4.3-r0 || =2.5.1-r0 || =2.5.2-r0 || =2.6.0-r0 || =2.7.0-r0 || =2.8.1-r0 || =2.9.1-r0 || >=0 <2.32.4-r0 | 2.32.4-r0 |
alpine v3.22 | | =1.0.4-r0 || =1.1.0-r0 || =1.2.3-r0 || =2.0.0-r0 || =2.10.0-r0 || =2.11.0-r0 || =2.11.1-r0 || =2.11.1-r1 || =2.12.4-r0 || =2.12.4-r1 || =2.13.0-r0 || =2.16.5-r0 || =2.17.3-r0 || =2.18.1-r0 || =2.18.1-r1 || =2.18.2-r0 || =2.18.3-r0 || =2.18.4-r0 || =2.19.1-r0 || =2.21.0-r0 || =2.21.0-r1 || =2.21.0-r2 || =2.21.0-r3 || =2.21.0-r4 || =2.21.0-r5 || =2.21.0-r6 || =2.22.0-r0 || =2.22.0-r1 || =2.23.0-r0 || =2.24.0-r0 || =2.24.0-r1 || =2.24.0-r2 || =2.24.0-r3 || =2.25.0-r0 || =2.25.0-r1 || =2.25.1-r0 || =2.25.1-r1 || =2.25.1-r2 || =2.25.1-r3 || =2.25.1-r4 || =2.26.0-r0 || =2.26.0-r1 || =2.26.0-r2 || =2.27.1-r0 || =2.28.1-r0 || =2.28.1-r1 || =2.28.1-r2 || =2.28.2-r0 || =2.28.2-r1 || =2.29.0-r0 || =2.3.0-r0 || =2.30.0-r0 || =2.31.0-r0 || =2.31.0-r1 || =2.31.0-r2 || =2.32.2-r0 || =2.32.3-r0 || =2.4.3-r0 || =2.5.1-r0 || =2.5.2-r0 || =2.6.0-r0 || =2.7.0-r0 || =2.8.1-r0 || =2.9.1-r0 || >=0 <2.32.4-r0 | 2.32.4-r0 |
 debian 11 | | =2.25.1+dfsg-2 || =2.27.1+dfsg-1 || =2.28.1+dfsg-1 || =2.31.0+dfsg-1 || =2.31.0+dfsg-2 || =2.32.3+dfsg-1 || =2.32.3+dfsg-2 || =2.32.3+dfsg-3 || =2.32.3+dfsg-4 || =2.32.3+dfsg-5 || =2.32.4+dfsg-1 || =2.32.5+dfsg-1 | - |
debian 12 | | =2.28.1+dfsg-1 || =2.31.0+dfsg-1 || =2.31.0+dfsg-2 || =2.32.3+dfsg-1 || =2.32.3+dfsg-2 || =2.32.3+dfsg-3 || =2.32.3+dfsg-4 || =2.32.3+dfsg-5 || =2.32.4+dfsg-1 || =2.32.5+dfsg-1 | - |
debian 13 | | =2.32.3+dfsg-5 || >=0 <2.32.3+dfsg-5+deb13u1 | 2.32.3+dfsg-5+deb13u1 |
debian 14 | | =2.32.3+dfsg-5 || >=0 <2.32.4+dfsg-1 | 2.32.4+dfsg-1 |
 pypi | | | 2.32.4 |
alpine v3.23 | | =1.0.4-r0 || =1.1.0-r0 || =1.2.3-r0 || =2.0.0-r0 || =2.10.0-r0 || =2.11.0-r0 || =2.11.1-r0 || =2.11.1-r1 || =2.12.4-r0 || =2.12.4-r1 || =2.13.0-r0 || =2.16.5-r0 || =2.17.3-r0 || =2.18.1-r0 || =2.18.1-r1 || =2.18.2-r0 || =2.18.3-r0 || =2.18.4-r0 || =2.19.1-r0 || =2.21.0-r0 || =2.21.0-r1 || =2.21.0-r2 || =2.21.0-r3 || =2.21.0-r4 || =2.21.0-r5 || =2.21.0-r6 || =2.22.0-r0 || =2.22.0-r1 || =2.23.0-r0 || =2.24.0-r0 || =2.24.0-r1 || =2.24.0-r2 || =2.24.0-r3 || =2.25.0-r0 || =2.25.0-r1 || =2.25.1-r0 || =2.25.1-r1 || =2.25.1-r2 || =2.25.1-r3 || =2.25.1-r4 || =2.26.0-r0 || =2.26.0-r1 || =2.26.0-r2 || =2.27.1-r0 || =2.28.1-r0 || =2.28.1-r1 || =2.28.1-r2 || =2.28.2-r0 || =2.28.2-r1 || =2.29.0-r0 || =2.3.0-r0 || =2.30.0-r0 || =2.31.0-r0 || =2.31.0-r1 || =2.31.0-r2 || =2.32.2-r0 || =2.32.3-r0 || =2.4.3-r0 || =2.5.1-r0 || =2.5.2-r0 || =2.6.0-r0 || =2.7.0-r0 || =2.8.1-r0 || =2.9.1-r0 || >=0 <2.32.4-r0 | 2.32.4-r0 |
