CVE-2024-47081 json
Requests vulnerable to .netrc credentials leak via malicious URLs
published last yr. modified 23d ago also EUVD-2025-17564 , GHSA-9hjg-9r4m-mvj7 , PYSEC-2026-1872
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
Patch / fix
- pypi requests 2.32.4
- python requests 2.32.4
- requests Debian 13 2.32.3+dfsg-5+deb13u1
- requests Debian 14 2.32.4+dfsg-1
debian advisories DEBIAN-CVE-2024-47081
- requests Ubuntu 22.04 LTS 2.25.1+dfsg-2ubuntu0.3
- requests Ubuntu 24.04 LTS 2.31.0+dfsg-1ubuntu1.1
- requests Ubuntu 25.10 2.32.3+dfsg-5ubuntu2
- python-pip Ubuntu 22.04 LTS 22.0.2+dfsg-1ubuntu0.7
- python-pip Ubuntu 24.04 LTS 24.0+dfsg-1ubuntu1.3
- requests Ubuntu Pro 14.04 LTS 2.2.1-1ubuntu0.4+esm1
- requests Ubuntu Pro 16.04 LTS 2.9.1-3ubuntu0.1+esm2
- requests Ubuntu Pro 18.04 LTS 2.18.4-2ubuntu0.1+esm2
ubuntu advisories UBUNTU-CVE-2024-47081
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- resource-agents RHEL 8 4.9.0-54.el8_10.16
- resource-agents-gcp RHEL 8 4.9.0-54.el8_10.16
- resource-agents-paf RHEL 8 4.9.0-54.el8_10.16
- resource-agents-aliyun RHEL 8 4.9.0-54.el8_10.16
- fence-agents RHEL 8 4.2.1-129.el8_10.14
- fence-agents-all RHEL 8 4.2.1-129.el8_10.14
- fence-agents-apc RHEL 8 4.2.1-129.el8_10.14
- fence-agents-aws RHEL 8 4.2.1-129.el8_10.14
red hat advisories RHSA-2025:15723RHSA-2025:15691RHSA-2025:15622RHSA-2025:15618RHSA-2025:15617RHSA-2025:15616
- python-requests Linux Micro 6.1 2.32.4-slfo.1.1_1.1
- python-requests Manager Client Tools 12 2.11.1-6.43.1
- python-requests SLE Module for Python 3 15 SP7, SLE Module for Python 3 15 SP6, SLE Module for Public Cloud 15 SP4 +1 more 2.31.0-150400.6.18.1
- python-requests Linux Micro 6.0 2.32.3-2.1
- python-requests SLES LTSS Extended Security 12 SP5, SLE Module for Public Cloud 12 2.24.0-8.23.1
- python-requests SLE Module for Basesystem 15 SP7, SLE Module for Basesystem 15 SP6, SLE Micro 5.5 +4 more 2.25.1-150300.3.15.1
- python3-requests SLES LTSS Extended Security 12 SP5 2.24.0-8.20.1
suse advisories SUSE-SU-2025:20531-1SUSE-SU-2025:02371-1SUSE-SU-2025:02205-1SUSE-SU-2025:20455-1SUSE-SU-2025:01999-1SUSE-SU-2025:01998-1
- oci-cli openSUSE Tumbleweed 3.76.2-1.1
- python-requests openSUSE Tumbleweed 2.32.4-1.1
opensuse advisories openSUSE-SU-2026:10539-1openSUSE-SU-2025:15281-1
- resource-agents AlmaLinux 8 4.9.0-54.el8_10.16
- resource-agents-gcp AlmaLinux 8 4.9.0-54.el8_10.16
- resource-agents-paf AlmaLinux 8 4.9.0-54.el8_10.16
- resource-agents-aliyun AlmaLinux 8 4.9.0-54.el8_10.16
- fence-agents-all AlmaLinux 8 4.2.1-129.el8_10.14
- fence-agents-apc AlmaLinux 8 4.2.1-129.el8_10.14
- fence-agents-eps AlmaLinux 8 4.2.1-129.el8_10.14
- fence-agents-rsa AlmaLinux 8 4.2.1-129.el8_10.14
almalinux advisories ALSA-2025:14999ALSA-2025:14750ALSA-2025:13604ALSA-2025:13234ALSA-2025:12519
- python-requests Rocky Linux 9 2.25.1-10.el9_6
- python-requests Rocky Linux 10 2.32.4-1.el10_0
- resource-agents Rocky Linux 8 4.9.0-54.el8_10.16
- fence-agents Rocky Linux 8 4.2.1-129.el8_10.14
- python-requests Rocky Linux 8 2.20.0-6.el8_10
rocky linux advisories RLSA-2025:12519RLSA-2025:13604RLSA-2025:14999RLSA-2025:14750RLSA-2025:13234
- py3-requests Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 2.32.4-r0
alpine advisories ALPINE-CVE-2024-47081
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python-requests Azure Linux 3.0 2.31.0-3
- python-requests CBL-Mariner 2.0 2.27.1-8
azure linux advisories AZL-63747AZL-63812
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- github.com/psf/requests@96ba401 commit
- github.com/psf/requests#6965 pull request
- github.com/psf/requests/releases/tag/v2.32.4 release
Is CVE-2024-47081 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-47081 updated cvss 5.3
requests: Requests vulnerable to .netrc credentials leak via malicious URLs
-
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9 Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-shared-resource-rhel9, openshift-builds/openshift-builds-shared-resource-webhook-rhel9 Red Hat Confidential Compute Attestation confidential-compute-attestation-tech-preview/trustee-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle Red Hat Multiarch Tuning Operator multiarch-tuning/multiarch-tuning-rhel9-operator Red Hat Network Observability Operator network-observability/network-observability-cli-rhel9affected: workaround, no fix available “Fix deferred”
+19 more productsfewer
Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-istio-controller-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/kiali-rhel9-operator, +3 more Red Hat AI Inference Server rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9 Red Hat Ansible Automation Platform 2 python-requests Red Hat build of Quarkus Native builder mandrel-for-jdk-21-rhel8 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/rhdh-rhel9-operator Red Hat Discovery 1 discovery/discovery-server-rhel9 Red Hat Edge Manager preview rhem/flightctl-api-rhel9, rhem/flightctl-worker-rhel9, rhem/flightctl-periodic-rhel9, rhem/flightctl-cli-artifacts-rhel9 Red Hat Enterprise Linux 6 python-requests Red Hat Enterprise Linux 7 python-pip, python3-pip, python-requests, resource-agents, resource-agents-gcp, resource-agents-sap, +4 more Red Hat Enterprise Linux 8 python-pip, python3-pip, python3.11-pip, python3.12-pip, python-requests, python3-requests, +4 more Red Hat Enterprise Linux 9 fence-virt, python-pip, fence-virtd, python3-pip, fence-agents, python3.11-pip, +58 more Red Hat Enterprise Linux 10 python-pip Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel8, rhoai/odh-feast-operator-rhel8, rhoai/odh-feature-server-rhel8, rhoai/odh-model-registry-rhel8, rhoai/odh-trustyai-service-rhel8, rhoai/odh-notebook-controller-rhel8, +3 more Red Hat OpenShift Container Platform 4 python-requests, openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenStack Platform 17.1 python-requests Red Hat Satellite 6 python-requests, python3-requests, satellite/iop-advisor-engine-rhel9 Red Hat Update Infrastructure 4 for Cloud Providers python-requests -
Red Hat Enterprise Linux AppStream (v. 8) fence-agents 4.2.1-129.el8_10.14, fence-agents-all 4.2.1-129.el8_10.14, fence-agents-apc 4.2.1-129.el8_10.14, fence-agents-eps 4.2.1-129.el8_10.14, fence-agents-rsa 4.2.1-129.el8_10.14, fence-agents-rsb 4.2.1-129.el8_10.14, +37 morefixed: vendor fix RHSA-2025:14750
-
Red Hat Enterprise Linux AppStream (v. 9) python3-requests+socks 2.25.1-10.el9_6, python3-requests+security 2.25.1-10.el9_6fixed: vendor fix RHSA-2025:12519
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents 4.2.1-65.el8_4.21, fence-agents-all 4.2.1-65.el8_4.21, fence-agents-apc 4.2.1-65.el8_4.21, fence-agents-eps 4.2.1-65.el8_4.21, fence-agents-rsa 4.2.1-65.el8_4.21, fence-agents-rsb 4.2.1-65.el8_4.21, +36 morefixed: vendor fix RHSA-2025:15622
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) fence-agents 4.2.1-89.el8_6.15, fence-agents-all 4.2.1-89.el8_6.15, fence-agents-apc 4.2.1-89.el8_6.15, fence-agents-eps 4.2.1-89.el8_6.15, fence-agents-rsa 4.2.1-89.el8_6.15, fence-agents-rsb 4.2.1-89.el8_6.15, +36 more Red Hat Enterprise Linux AppStream E4S (v.8.6) fence-agents 4.2.1-89.el8_6.15, fence-agents-all 4.2.1-89.el8_6.15, fence-agents-apc 4.2.1-89.el8_6.15, fence-agents-eps 4.2.1-89.el8_6.15, fence-agents-rsa 4.2.1-89.el8_6.15, fence-agents-rsb 4.2.1-89.el8_6.15, +37 morefixed: vendor fix RHSA-2025:15615
-
Red Hat Enterprise Linux AppStream E4S (v.8.8) fence-agents 4.2.1-112.el8_8.11, fence-agents-all 4.2.1-112.el8_8.11, fence-agents-apc 4.2.1-112.el8_8.11, fence-agents-eps 4.2.1-112.el8_8.11, fence-agents-rsa 4.2.1-112.el8_8.11, fence-agents-rsb 4.2.1-112.el8_8.11, +36 morefixed: vendor fix RHSA-2025:15614
-
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) fence-agents 4.2.1-65.el8_4.21, fence-agents-all 4.2.1-65.el8_4.21, fence-agents-apc 4.2.1-65.el8_4.21, fence-agents-eps 4.2.1-65.el8_4.21, fence-agents-rsa 4.2.1-65.el8_4.21, fence-agents-rsb 4.2.1-65.el8_4.21, +33 morefixed: vendor fix RHSA-2025:15622
-
Red Hat Enterprise Linux AppStream TUS (v.8.6) fence-agents 4.2.1-89.el8_6.15, fence-agents-all 4.2.1-89.el8_6.15, fence-agents-apc 4.2.1-89.el8_6.15, fence-agents-eps 4.2.1-89.el8_6.15, fence-agents-rsa 4.2.1-89.el8_6.15, fence-agents-rsb 4.2.1-89.el8_6.15, +36 morefixed: vendor fix RHSA-2025:15615
show 7 moreshow fewer
-
Red Hat Enterprise Linux AppStream TUS (v.8.8) fence-agents 4.2.1-112.el8_8.11, fence-agents-all 4.2.1-112.el8_8.11, fence-agents-apc 4.2.1-112.el8_8.11, fence-agents-eps 4.2.1-112.el8_8.11, fence-agents-rsa 4.2.1-112.el8_8.11, fence-agents-rsb 4.2.1-112.el8_8.11, +36 morefixed: vendor fix RHSA-2025:15614
-
Red Hat Enterprise Linux BaseOS (v. 8) python-requests 2.20.0-6.el8_10, python3-requests 2.20.0-6.el8_10fixed: vendor fix RHSA-2025:13234
-
Red Hat Enterprise Linux BaseOS (v. 9) python-requests 2.25.1-10.el9_6, python3-requests 2.25.1-10.el9_6fixed: vendor fix RHSA-2025:12519
-
Red Hat Enterprise Linux BaseOS (v. 10) python-requests 2.32.4-1.el10_0, python3-requests 2.32.4-1.el10_0fixed: vendor fix RHSA-2025:13604
-
Red Hat Enterprise Linux BaseOS AUS (v. 8.2) python-requests 2.20.0-3.el8_2, python3-requests 2.20.0-3.el8_2fixed: vendor fix RHSA-2025:15723
-
Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-requests 2.20.0-3.el8_4, python3-requests 2.20.0-3.el8_4fixed: vendor fix RHSA-2025:15691
-
Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-requests 2.20.0-3.el8_6.1, python3-requests 2.20.0-3.el8_6.1fixed: vendor fix RHSA-2025:15122
14 more fixed, 1 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | requests | <2.32.4 |
2.32.4 |
Affected products
- psf requests
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
github.com
/psf/requests/pull/6965
web
-
github.com
/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef
web, patch
-
github.com
/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7
web, advisory
-
requests.readthedocs.io
/en/latest/api/#requests.Session.trust_env
web
-
seclists.org
/fulldisclosure/2025/Jun/2
web
-
seclists.org
/fulldisclosure/2025/Jun/2
web
-
openwall.com
/lists/oss-security/2025/06/03/9
web
-
openwall.com
/lists/oss-security/2025/06/03/11
web
-
openwall.com
/lists/oss-security/2025/06/04/1
web
-
openwall.com
/lists/oss-security/2025/06/04/6
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-47081
advisory
-
github.com
/advisories/GHSA-9hjg-9r4m-mvj7
advisory
-
github.com
/psf/requests
package
-
github.com
/psf/requests/releases/tag/v2.32.4
web
-
github.com
/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2026-1872.yaml
web
-
pypi.org
/project/requests
web, package
Sources
- CVE List CVE-2024-47081
- GitHub Advisory GHSA-9hjg-9r4m-mvj7
- NVD CVE-2024-47081
- OSV PYSEC-2026-1872
- Maintainer advisory GHSA-9hjg-9r4m-mvj7
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of psf/requests published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.