Live › vulnerability › CVE-2024-47081
Go to dashboardThe Python Requests library before 2.32.4 can send .netrc credentials to third-party hosts when given a specially crafted URL. An attacker who can get the application to fetch such a URL can capture the username and password stored for other hosts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product |
|---|
| Ecosystem |
|---|
| Affected |
|---|
| Fixed in |
|---|
| requests | pypi | < 2.32.4 | 2.32.4 |
Run: pip show requests (version below 2.32.4 is affected)
Check whether a .netrc file exists in the home directory of the process user (for example ~/.netrc)
Search the lockfile for requests: grep -i requests requirements*.txt poetry.lock uv.lock
2.32.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).
https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2
This page as .md · .json · in your agent: get_signal("CVE-2024-47081")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.