PkgSeer

Vulnerability PYSEC-2026-1872

Medium Risk

3 months ago

Requests vulnerable to .netrc credentials leak via malicious URLs

0.0.1 - 0.12.01 and 0.12.1 - 2.32.3

Summary

Requests vulnerable to .netrc credentials leak via malicious URLs

Details

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session ( docs).

References

https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Requests `Session` object does not verify requests after making first request with verify=False

0.0.1 - 0.12.01 and 0.12.1 - 2.31.0 PYSEC-2026-1873

No summary available

0.0.1 - 0.12.01 and 0.12.1 - 2.32.5 PYSEC-2026-2275

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

0.0.1 - 0.12.01 and 0.12.1 - 2.32.5 GHSA-gc5v-m9x4-r6x2

Requests vulnerable to .netrc credentials leak via malicious URLs

0.0.1 - 0.12.01 and 0.12.1 - 2.32.3 GHSA-9hjg-9r4m-mvj7

Requests `Session` object does not verify requests after making first request with verify=False

0.0.1 - 0.12.01 and 0.12.1 - 2.31.0 GHSA-9wx4-h78v-vm56

View all vulnerabilities for these packages

Impacted packages

requests

Timeline

Published

3 months ago

Fixed (2.32.4)

1 year ago

Last Modified

3 months ago