CVE-2024-47081

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-47081
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-47081.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-47081
Aliases
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CGA (346)
CLEANSTART (10)
CLSA (4)
DEBIAN (1)
ECHO (1)
MINI (7)
OESA (14)
openSUSE (2)
RHSA (15)
RLSA (5)
ROOT (1)
SUSE (7)
UBUNTU (1)
Related
ALSA (5)
openSUSE (2)
SUSE (7)
Published
2025-06-09T17:57:47Z
Modified
2026-08-12T03:30:42Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Requests vulnerable to .netrc credentials leak via malicious URLs
Details

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on one's Requests Session.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-522"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47081.json"
}
References

Affected packages

Git / github.com/psf/requests

Affected ranges

Type
GIT
Repo
https://github.com/psf/requests
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
96ba401c1296ab1dda74a2365ef36d88f7d144ef
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.32.4"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.0
v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.10.6
v0.10.7
v0.10.8
v0.11.1
v0.12.0
v0.12.1
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.13.4
v0.13.5
v0.13.6
v0.13.7
v0.13.9
v0.14.0
v0.14.1
v0.14.2
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.3.0
v0.3.2
v0.3.3
v0.3.4
v0.4.0
v0.4.1
v0.5.0
v0.5.1
v0.6.3
v0.6.4
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.3
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v2.*
v2.0
v2.0.0
v2.0.1
v2.1.0
v2.10.0
v2.11.0
v2.11.1
v2.12.0
v2.12.1
v2.12.2
v2.12.3
v2.12.4
v2.12.5
v2.14.0
v2.14.1
v2.14.2
v2.15.0
v2.15.1
v2.16.0
v2.16.1
v2.16.2
v2.16.3
v2.16.4
v2.16.5
v2.17.0
v2.17.1
v2.17.3
v2.18.2
v2.18.3
v2.19.0
v2.19.1
v2.2.0
v2.2.1
v2.20.1
v2.24.0
v2.25.0
v2.25.1
v2.26.0
v2.27.0
v2.27.1
v2.28.0
v2.28.1
v2.28.2
v2.29.0
v2.3.0
v2.30.0
v2.31.0
v2.32.0
v2.32.1
v2.32.2
v2.32.3
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.8.0
v2.8.1
v2.9.0
v2.9.1
v2.9.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-47081.json"