CVE-2024-47081: Requests vulnerable to .netrc credentials leak via malicious URLs
### Impact Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. ### Workarounds For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)). ### References https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47081?
CVE-2024-47081 is characterized as a moderate severity vulnerability due to the potential leakage of .netrc credentials.
How do I fix CVE-2024-47081?
To resolve CVE-2024-47081, update the Requests library to version 2.32.4 or higher.
What issue does CVE-2024-47081 address?
CVE-2024-47081 addresses a URL parsing issue that may allow .netrc credentials to be leaked to third parties via specially crafted URLs.
Which versions of Requests are affected by CVE-2024-47081?
Requests versions prior to 2.32.4 are affected by CVE-2024-47081.
Is there a workaround for CVE-2024-47081 if I cannot update?
Yes, you can disable the use of the .netrc file by setting `trust_env=False` in your Requests.