CVE-2024-47081: Requests vulnerable to .netrc credentials leak via malicious URLs
Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
Workarounds For older versions of Requests, use of the .netrc file can be disabled with trustenv=False on your Requests Session (docs).
References https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2
Other sources
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with trustenv=False on one's Requests Session.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/requeststo a version that resolves this vulnerability.Fixed in 2.32.4 - Upgrade
Upgrade
requeststo a version that resolves this vulnerability.Fixed in 2.32.4 - Configuration
For Requests versions prior to 2.32.4, disable .netrc usage by setting `trust_env=False` on your Requests Session (e.g., `requests.Session().trust_env = False`).
Requests Session trust_env = False
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47081?
CVE-2024-47081 is characterized as a moderate severity vulnerability due to the potential leakage of .netrc credentials.
How do I fix CVE-2024-47081?
To resolve CVE-2024-47081, update the Requests library to version 2.32.4 or higher.
What issue does CVE-2024-47081 address?
CVE-2024-47081 addresses a URL parsing issue that may allow .netrc credentials to be leaked to third parties via specially crafted URLs.
Which versions of Requests are affected by CVE-2024-47081?
Requests versions prior to 2.32.4 are affected by CVE-2024-47081.
Is there a workaround for CVE-2024-47081 if I cannot update?
Yes, you can disable the use of the .netrc file by setting `trust_env=False` in your Requests.