CVE-2024-47081Medium· 5.3▾ SunlitRequests vulnerable to .netrc credentials leak via malicious URLs
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.8%
Last analysed / modified upstream
0.8% → 1.0%
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).
https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2
requests < 2.32.4Upgrade to a patched release:
requests 2.32.4Connected by shared product, vendor, weakness, or advisory.
CVE-2023-32681Medium· 6.1Unintended leak of Proxy-Authorization header in requests
CVE-2026-25645Medium· 4.4Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
CVE-2024-35195Medium· 5.6Requests `Session` object does not verify requests after making first request with verify=False