---
id: CVE-2024-41124
aliases:
  - GHSA-rwcj-7jjp-4w38
  - PYSEC-2026-1809
title: >-
  [PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP
  urls in `API_URLS`
summary: >-
  [PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP
  urls in `API_URLS`
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L'
vendor: puncia
product: puncia
ecosystem: pip
affected:
  - puncia < 0.21
patched:
  - puncia 0.21
published: '2024-07-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:16.954047550Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-rwcj-7jjp-4w38'
references:
  - url: >-
      https://github.com/ARPSyndicate/puncia/security/advisories/GHSA-rwcj-7jjp-4w38
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-41124'
  - url: 'https://github.com/ARPSyndicate/puncia/issues/8'
  - url: >-
      https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd
  - url: >-
      https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd#diff-3ec6c2de51e702726b23c452e3f4a899f6f4253af9fbf5be7254a5c1407ab526
  - url: 'https://github.com/ARPSyndicate/puncia'
tags:
  - osv
  - pip
epss: 0.0027
epssPercentile: 0.19462
ingestedAt: '2026-07-08T18:25:53.036Z'
---

## Overview

### Impact
`API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks.

### References
[ISSUE](https://github.com/ARPSyndicate/puncia/issues/8)
[PATCH](https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd#diff-3ec6c2de51e702726b23c452e3f4a899f6f4253af9fbf5be7254a5c1407ab526)


## Affected packages

- `puncia < 0.21`

## Remediation

Upgrade to a patched release:

- `puncia 0.21`