---
schema_version: '1.0'
id: security-20260708-caa7d4
url: https://osv.dev/vulnerability/PYSEC-2026-1872
url_hash: caa7d46858e8cc373f47868ea5cc2b66e82a9644358fa1a5e1a1dc9314491458
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-1872
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2024-47081
- PYSEC-2026-1872
- severity:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- requests
- PyPI
lang: en
published_at: '2026-07-07T16:02:54Z'
fetched_at: '2026-07-08T15:37:25Z'
updated_at: '2026-07-11T06:37:45Z'
status: published
content_hash: 783575a7c0985eb1fd750bc5b78fbc62c99c5e7be78d3d685b233a0f99a457bb
license_note: full
summary: Requests vulnerable to .netrc credentials leak via malicious URLs
summary_source: rss
summary_en: Requests vulnerable to .netrc credentials leak via malicious URLs
entities: []
related_auto: []
title: 'CVE-2024-47081: Requests vulnerable to .netrc credentials leak via malicious
  URLs'
---

# CVE-2024-47081: Requests vulnerable to .netrc credentials leak via malicious URLs

## TL;DR
Requests vulnerable to .netrc credentials leak via malicious URLs

## Key Points
- cve / CVE-2024-47081 / PYSEC-2026-1872 / severity:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N / requests / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
**Advisory:** PYSEC-2026-1872 (CVE-2024-47081)

**Affected (your watchlist):**
- `PyPI:requests` 2.31.0 → fixed in 2.32.4 [docker/docker-strands+docker/local+docker/mac]
- `PyPI:requests` 2.32.3 → fixed in 2.32.4 [mac]

**Details:**
### Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

### Workarounds
For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).

### References
https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2

**References:**
- https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7
- https://nvd.nist.gov/vuln/detail/CVE-2024-47081
- https://github.com/psf/requests/pull/6965
- https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef
- https://github.com/psf/requests
- https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env
- https://seclists.org/fulldisclosure/2025/Jun/2
- http://seclists.org/fulldisclosure/2025/Jun/2
- http://www.openwall.com/lists/oss-security/2025/06/03/11
- http://www.openwall.com/lists/oss-security/2025/06/03/9

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-1872_

## Source
元記事: [CVE-2024-47081: Requests vulnerable to .netrc credentials leak via malicious URLs](https://osv.dev/vulnerability/PYSEC-2026-1872) — published 2026-07-07T16:02:54Z