{"id":"CVE-2024-47081","aliases":["GHSA-9hjg-9r4m-mvj7","PYSEC-2026-1872"],"title":"Requests vulnerable to .netrc credentials leak via malicious URLs","summary":"Requests vulnerable to .netrc credentials leak via malicious URLs","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","vendor":"requests","product":"requests","ecosystem":"pip","affected":["requests < 2.32.4"],"patched":["requests 2.32.4"],"published":"2025-06-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:25.139398550Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7","references":[{"url":"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081"},{"url":"https://github.com/psf/requests/pull/6965"},{"url":"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef"},{"url":"https://github.com/psf/requests"},{"url":"https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env"},{"url":"https://seclists.org/fulldisclosure/2025/Jun/2"},{"url":"http://seclists.org/fulldisclosure/2025/Jun/2"},{"url":"http://www.openwall.com/lists/oss-security/2025/06/03/11"},{"url":"http://www.openwall.com/lists/oss-security/2025/06/03/9"},{"url":"http://www.openwall.com/lists/oss-security/2025/06/04/1"},{"url":"http://www.openwall.com/lists/oss-security/2025/06/04/6"}],"tags":["osv","pip"],"epss":0.0098,"epssPercentile":0.60745,"ingestedAt":"2026-07-08T18:25:48.022Z","slug":"CVE-2024-47081","body":"## Overview\n\n### Impact\n\nDue to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.\n\n### Workarounds\nFor older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).\n\n### References\nhttps://github.com/psf/requests/pull/6965\nhttps://seclists.org/fulldisclosure/2025/Jun/2\n\n## Affected packages\n\n- `requests < 2.32.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `requests 2.32.4`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}