{"id":"CVE-2024-41124","aliases":["GHSA-rwcj-7jjp-4w38","PYSEC-2026-1809"],"title":"[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`","summary":"[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`","severity":"low","cvss":3.8,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","vendor":"puncia","product":"puncia","ecosystem":"pip","affected":["puncia < 0.21"],"patched":["puncia 0.21"],"published":"2024-07-19","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:16.954047550Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-rwcj-7jjp-4w38","references":[{"url":"https://github.com/ARPSyndicate/puncia/security/advisories/GHSA-rwcj-7jjp-4w38"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41124"},{"url":"https://github.com/ARPSyndicate/puncia/issues/8"},{"url":"https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd"},{"url":"https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd#diff-3ec6c2de51e702726b23c452e3f4a899f6f4253af9fbf5be7254a5c1407ab526"},{"url":"https://github.com/ARPSyndicate/puncia"}],"tags":["osv","pip"],"epss":0.0027,"epssPercentile":0.19453,"ingestedAt":"2026-07-08T18:25:53.036Z","slug":"CVE-2024-41124","body":"## Overview\n\n### Impact\n`API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks.\n\n### References\n[ISSUE](https://github.com/ARPSyndicate/puncia/issues/8)\n[PATCH](https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd#diff-3ec6c2de51e702726b23c452e3f4a899f6f4253af9fbf5be7254a5c1407ab526)\n\n\n## Affected packages\n\n- `puncia < 0.21`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `puncia 0.21`","depth":"sunlit","depthScore":21,"depthScoreParts":{"impact":20.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}