psf requests vulnerabilities

Latest psf requests CVEs

Newest publication first

1. CVE-2026-25645 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

   Published 2026-03-25

   Medium·CVSS 5.5 EPSS 0.19%

   Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validat...

2. CVE-2024-47081 Requests vulnerable to .netrc credentials leak via malicious URLs

   Published 2025-06-09

   Medium·CVSS 5.3 EPSS 1.0%

   Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc...

3. CVE-2024-35195 Requests `Session` object does not verify requests after making first request with verify=False

   Published 2024-05-20

   Medium·CVSS 5.6 EPSS 0.34%

   Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to t...

4. CVE-2023-32681 Unintended leak of Proxy-Authorization header in requests

   Published 2023-05-26

   Medium·CVSS 6.1 EPSS 3.0%

   Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use rebuild_proxies to reattach the Proxy-Authorization header to requests. For HTTP co...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.