requests
PyPI7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting requestspage 1 of 1
- CVE-2014-1829NONECVSS 0.0EG 0.0✓ Fixed in 2.3.02014-10-15
vulnerable: 0.0.1 ... 2.2.1 (84 versions)
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
- CVE-2014-1830NONECVSS 0.0EG 0.0✓ Fixed in 2.3.02014-10-15
vulnerable: 0.0.1 ... 2.2.1 (84 versions)
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.
- CVE-2015-2296NONECVSS 0.0EG 0.0✓ Fixed in 2.6.02015-03-18
vulnerable: 2.1.0 ... 2.5.3 (12 versions)
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
- CVE-2018-18074HIGHCVSS 7.5EG 7.5✓ Fixed in 2.20.02018-10-09
vulnerable: 0.0.1 ... 2.9.2 (134 versions)
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the netwo…
- CVE-2023-32681MEDIUMCVSS 6.1EG 6.1✓ Fixed in 2.31.02023-05-26
vulnerable: 2.10.0 ... 2.9.2 (66 versions)
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-A…
- CVE-2024-35195MEDIUMCVSS 5.6EG 5.6✓ Fixed in 2.32.02024-05-20
vulnerable: 0.0.1 ... 2.9.2 (151 versions)
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore…
- CVE-2024-47081MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2.32.42025-06-09
vulnerable: 0.0.1 ... 2.9.2 (155 versions)
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For olde…
Check whether requests is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for requests CVEs against the assets you own.
Start Free Scan →