Vulnerability · Published Jun 9, 2025 · Assigned by GitHub_M
CVE-2024-47081Requests vulnerable to .netrc credentials leak via malicious URLs
Medium 5.3
In plain English
A medium-severity security flaw in requests from psf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.0%top 36.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | fence-agents-all | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-amt-ws | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-apc | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-apc-snmp | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-bladecenter | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-brocade | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-cisco-mds | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-cisco-ucs | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-common | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-compute | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-drac5 | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-eaton-snmp | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-emerson | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-eps | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-heuristics-ping | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-hpblade | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-ibm-powervs | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-ibm-vpc | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-ibmblade | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-ifmib | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-ilo-moonshot | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-ilo-mp | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-ilo-ssh | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-ilo2 | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-intelmodular | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-ipdu | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-ipmilan | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-kdump | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-kubevirt | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-lpar | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-mpath | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-redfish | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-rhevm | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-rsa | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-rsb | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-sbd | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-scsi | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-virsh | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-vmware-rest | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-vmware-soap | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-wti | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:8 | fence-agents-zvm | 4.2.1-129.el8_10.14 | ALSA-2025:14750 |
| AlmaLinux:10 | python3-requests | 2.32.4-1.el10_0 | ALSA-2025:13604 |
| AlmaLinux:8 | python3-requests | 2.20.0-6.el8_10 | ALSA-2025:13234 |
| AlmaLinux:9 | python3-requests | 2.25.1-10.el9_6 | ALSA-2025:12519 |
| AlmaLinux:9 | python3-requests+security | 2.25.1-10.el9_6 | ALSA-2025:12519 |
| AlmaLinux:9 | python3-requests+socks | 2.25.1-10.el9_6 | ALSA-2025:12519 |
| AlmaLinux:8 | resource-agents | 4.9.0-54.el8_10.16 | ALSA-2025:14999 |
| AlmaLinux:8 | resource-agents-aliyun | 4.9.0-54.el8_10.16 | ALSA-2025:14999 |
| AlmaLinux:8 | resource-agents-gcp | 4.9.0-54.el8_10.16 | ALSA-2025:14999 |
| AlmaLinux:8 | resource-agents-paf | 4.9.0-54.el8_10.16 | ALSA-2025:14999 |
| Alpine:v3.20 | py3-requests | 2.32.4-r0 | ALPINE-CVE-2024-47081 |
| Alpine:v3.21 | py3-requests | 2.32.4-r0 | ALPINE-CVE-2024-47081 |
| Alpine:v3.22 | py3-requests | 2.32.4-r0 | ALPINE-CVE-2024-47081 |
| Alpine:v3.23 | py3-requests | 2.32.4-r0 | ALPINE-CVE-2024-47081 |
| Alpine:v3.24 | py3-requests | 2.32.4-r0 | ALPINE-CVE-2024-47081 |
| Debian:12 | requests | no fix listed | DEBIAN-CVE-2024-47081 |
| Debian:13 | requests | 2.32.3+dfsg-5+deb13u1 | DEBIAN-CVE-2024-47081 |
| Debian:14 | requests | 2.32.4+dfsg-1 | DEBIAN-CVE-2024-47081 |
| PyPI | requests | 2.32.4 | PYSEC-2026-1872 |
| PyPI | requests | 2.32.4 | GHSA-9hjg-9r4m-mvj7 |
| Rocky Linux:8 | fence-agents | 0:4.2.1-129.el8_10.14 | RLSA-2025:14750 |
| Rocky Linux:10 | python-requests | 0:2.32.4-1.el10_0 | RLSA-2025:13604 |
| Rocky Linux:8 | python-requests | 0:2.20.0-6.el8_10 | RLSA-2025:13234 |
| Rocky Linux:9 | python-requests | 0:2.25.1-10.el9_6 | RLSA-2025:12519 |
| Rocky Linux:8 | resource-agents | 0:4.9.0-54.el8_10.16 | RLSA-2025:14999 |
| Ubuntu:22.04:LTS | python-pip | 22.0.2+dfsg-1ubuntu0.7 | UBUNTU-CVE-2024-47081 |
| Ubuntu:22.04:LTS | python-pip | 22.0.2+dfsg-1ubuntu0.7 | USN-7762-1 |
| Ubuntu:24.04:LTS | python-pip | 24.0+dfsg-1ubuntu1.3 | USN-7762-1 |
| Ubuntu:24.04:LTS | python-pip | 24.0+dfsg-1ubuntu1.3 | UBUNTU-CVE-2024-47081 |
| Ubuntu:22.04:LTS | requests | 2.25.1+dfsg-2ubuntu0.3 | UBUNTU-CVE-2024-47081 |
| Ubuntu:22.04:LTS | requests | 2.25.1+dfsg-2ubuntu0.3 | USN-7568-1 |
| Ubuntu:24.04:LTS | requests | 2.31.0+dfsg-1ubuntu1.1 | USN-7568-1 |
| Ubuntu:24.04:LTS | requests | 2.31.0+dfsg-1ubuntu1.1 | UBUNTU-CVE-2024-47081 |
| Ubuntu:25.10 | requests | 2.32.3+dfsg-5ubuntu2 | UBUNTU-CVE-2024-47081 |
Affected products (as reported)
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7 x_refsource_CONFIRM
- https://github.com/psf/requests/pull/6965 x_refsource_MISC
- https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef x_refsource_MISC
- https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env x_refsource_MISC
- https://seclists.org/fulldisclosure/2025/Jun/2 x_refsource_MISC
- http://seclists.org/fulldisclosure/2025/Jun/2
- http://www.openwall.com/lists/oss-security/2025/06/03/9
- http://www.openwall.com/lists/oss-security/2025/06/03/11
- http://www.openwall.com/lists/oss-security/2025/06/04/1
- http://www.openwall.com/lists/oss-security/2025/06/04/6