debian/requests vulnerabilities

Latest debian/requests CVEs

Newest publication first

1. CVE-2026-25645 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

   Published 2026-03-25

   Medium·CVSS 5.5 EPSS 0.19%

   Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validat...

2. CVE-2024-47081 Requests vulnerable to .netrc credentials leak via malicious URLs

   Published 2025-06-09

   Medium·CVSS 5.3 EPSS 1.0%

   Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc...

3. CVE-2024-35195 Requests `Session` object does not verify requests after making first request with verify=False

   Published 2024-05-20

   Medium·CVSS 5.6 EPSS 0.34%

   Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to t...

4. DLA-3456-1 requests - security update

   Published 2023-06-18

   Unknown

5. CVE-2023-32681 Unintended leak of Proxy-Authorization header in requests

   Published 2023-05-26

   Medium·CVSS 6.1 EPSS 3.0%

   Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use rebuild_proxies to reattach the Proxy-Authorization header to requests. For HTTP co...

6. CVE-2018-18074 Insufficiently Protected Credentials in Requests

   Published 2018-10-09

   High·CVSS 7.5 EPSS 6.9%

   The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

7. CVE-2015-2296 Python Requests Session Fixation

   Published 2015-03-18

   Medium·CVSS 6.8 EPSS 3.2%

   The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

8. DSA-3146-1 requests - security update

   Published 2015-01-30

   Unknown

9. CVE-2014-1829 Exposure of Sensitive Information to an Unauthorized Actor in Requests

   Published 2014-10-15

   Medium·CVSS 5.0 EPSS 2.2%

   Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.

10. CVE-2014-1830 Exposure of Sensitive Information to an Unauthorized Actor in Requests

    Published 2014-10-15

    Medium·CVSS 5.0 EPSS 2.0%

    Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.