Vulnerability in Psf Requests
CVE-2024-47081
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For olde…
EPSS: 0.002 (43.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Psf Requests — versions < 2.32.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7 (x_refsource_CONFIRM)
- https://github.com/psf/requests/pull/6965 (x_refsource_MISC)
- https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef (x_refsource_MISC)
- https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env (x_refsource_MISC)
- https://seclists.org/fulldisclosure/2025/Jun/2 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-47081?
- CVE-2024-47081 is a medium-severity vulnerability in Psf Requests, classified under Insufficiently Protected Credentials. CVSS score: 5.3/10. Published 2025-06-09.
- How severe is CVE-2024-47081?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2024-47081 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.