---
id: CVE-2024-47081
aliases:
  - GHSA-9hjg-9r4m-mvj7
  - PYSEC-2026-1872
title: Requests vulnerable to .netrc credentials leak via malicious URLs
summary: Requests vulnerable to .netrc credentials leak via malicious URLs
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'
vendor: requests
product: requests
ecosystem: pip
affected:
  - requests < 2.32.4
patched:
  - requests 2.32.4
published: '2025-06-09'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:25.139398550Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7'
references:
  - url: 'https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-47081'
  - url: 'https://github.com/psf/requests/pull/6965'
  - url: >-
      https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef
  - url: 'https://github.com/psf/requests'
  - url: 'https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env'
  - url: 'https://seclists.org/fulldisclosure/2025/Jun/2'
  - url: 'http://seclists.org/fulldisclosure/2025/Jun/2'
  - url: 'http://www.openwall.com/lists/oss-security/2025/06/03/11'
  - url: 'http://www.openwall.com/lists/oss-security/2025/06/03/9'
  - url: 'http://www.openwall.com/lists/oss-security/2025/06/04/1'
  - url: 'http://www.openwall.com/lists/oss-security/2025/06/04/6'
tags:
  - osv
  - pip
epss: 0.0098
epssPercentile: 0.60629
ingestedAt: '2026-07-08T18:25:48.022Z'
---

## Overview

### Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

### Workarounds
For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).

### References
https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2

## Affected packages

- `requests < 2.32.4`

## Remediation

Upgrade to a patched release:

- `requests 2.32.4`