CVE-2024-47081
Aliases:GHSA-9hjg-9r4m-mvj7PYSEC-2026-1872DEBIAN-CVE-2024-47081RHSA-2025:12519RHSA-2025:13234RHSA-2025:13604RHSA-2025:14750RHSA-2025:14999RHSA-2025:15121RHSA-2025:15122RHSA-2025:15614RHSA-2025:15615RHSA-2025:15616RHSA-2025:15617RHSA-2025:15618RHSA-2025:15622RHSA-2025:15691RHSA-2025:15723ALPINE-CVE-2024-47081CGA-24xh-xxr9-5g5xCGA-255g-7qrf-hrp8CGA-268x-cg74-v93xCGA-27fh-rh78-gr6rCGA-27p2-6jph-68h4CGA-2f43-9mch-4rmhCGA-2jc4-m73v-227hCGA-2mjv-6cp6-h6m5CGA-2vjq-6phg-p46hCGA-2xm7-f88q-v7mmCGA-32w7-vxvx-4w83CGA-33hp-f6c8-pmqpCGA-35pc-cm8x-54cwCGA-36gv-rmmx-mrx9CGA-37g3-q37f-3f45CGA-38rv-cj78-2v64CGA-3975-f9hv-x38fCGA-3f88-3c4m-5qq8CGA-3fpf-h4w5-gcw6CGA-3ghv-mhmq-8xprCGA-3h3g-85g2-chqjCGA-3m6w-p24j-99j8CGA-3p63-frqw-qg9vCGA-3q64-cc7h-86hvCGA-438m-pwxv-c6fqCGA-43qh-8h34-fx29CGA-46c2-6fx2-j8hxCGA-47mp-g7q4-v55rCGA-49q2-5m86-6cr6CGA-4c64-4cm9-vm8xCGA-4cjx-36ff-cgxhCGA-4hm2-59mg-qxpgCGA-4p2q-2333-g7q8CGA-4q36-xjfw-m5jjCGA-4rpm-hcgh-fjh9CGA-4xfx-mgx3-fwh3CGA-54fm-ff22-q99rCGA-574c-7pf6-v8hqCGA-57m3-56m6-rhmxCGA-5gc9-g2rj-38rrCGA-5gcw-9q34-3pc7CGA-5j36-742m-qhw2CGA-5pcg-jh4g-jvwhCGA-5q9m-pcpr-f9jqCGA-5rm7-f6pv-rvc5CGA-5rp4-7w29-89p2CGA-5rv6-w7ph-g2mqCGA-6276-v43j-57pfCGA-62jg-m6rr-4qw6CGA-62mf-xw4v-rj7pCGA-646g-6xq4-294mCGA-64hj-hg3q-wwv6CGA-6cq9-59x8-gr9fCGA-6j49-2jr5-5xcqCGA-6r79-gfv6-85xcCGA-6vv3-3cwq-265xCGA-6wc4-2fw5-wv4hCGA-6xp2-cq7q-7m87CGA-6xxm-8447-48qpCGA-76r8-mxj2-32wqCGA-792w-92q7-v6mqCGA-797x-v7m8-x572CGA-7cgw-47pf-q8cgCGA-7gx7-mmmf-4jxqCGA-7pgm-jghq-9pwhCGA-7vfg-435v-hrg5CGA-7wrm-mhq9-xg9wCGA-7xx5-w9m2-pg5gCGA-82w6-46hw-85vvCGA-83q4-c972-jq55CGA-86m2-qm9f-6986CGA-86qj-pg63-857jCGA-86w6-4p87-5g6qCGA-8cvm-v4rv-r4qrCGA-8g73-37wh-82j2CGA-8hv5-gc2q-r95mCGA-8j32-j7j5-prjqCGA-8m8r-g229-hvwgCGA-8p5h-w497-m9j2CGA-8q76-3w6f-p5f6CGA-8r7c-cpmg-gcrxCGA-8r8j-2c6h-wrrrCGA-8vfx-288m-vpfhCGA-92hc-7w8g-f23xCGA-93wc-jrqm-m6v4CGA-97r3-25cm-9f48CGA-98fx-r4h6-6x2jCGA-9j33-c929-fghvCGA-9jq2-725p-h6q8CGA-9q8x-9j94-29rmCGA-9qf3-pjg2-4q84CGA-c2c3-hqmf-5v95CGA-c4p9-whjv-mrvqCGA-c57f-vm8v-g7x8CGA-c5fq-p74r-vfjpCGA-c75j-rfrf-h7j5CGA-c9vv-7wqx-p565CGA-cgw5-966v-63c9CGA-cj9j-6gf2-g6rrCGA-cmxf-93m2-c44wCGA-cqh2-75gg-3m3gCGA-cxq2-883g-xrhqCGA-f2q7-53fc-p7hcCGA-f37g-xfm4-46wcCGA-f799-m49g-2p47CGA-f8j8-qxhf-cvqwCGA-fc8f-86fj-fwxjCGA-ff2r-2f43-2w8cCGA-fgcx-wg9g-rp6mCGA-fhxq-gwgc-pgmfCGA-fm32-x7hj-cf6rCGA-fpj2-rhjm-334cCGA-fvr6-2m6r-g8rmCGA-g86r-g75r-237jCGA-g9hc-x5jv-6fcxCGA-gpmh-c29h-qr6wCGA-grf5-5vc9-5wjpCGA-grwm-7m87-q9xqCGA-gx8f-vxfr-w9hqCGA-h2gh-96jj-v7q5CGA-h337-448g-h78xCGA-h476-x2fc-pqx4CGA-h794-h6j3-2h46CGA-h99v-9x8x-6p24CGA-hf3x-fpxg-mjhqCGA-hqqx-96r2-h58gCGA-hvjv-3h4w-8637CGA-hw7g-jr8j-548gCGA-hwhh-vp7j-42gvCGA-hwvc-cfw6-6g3cCGA-j4fp-7q72-p2pxCGA-j4pv-grh4-8gj8CGA-j6gw-gcj6-m897CGA-j7v3-jrfq-cgv5CGA-j93x-36j7-7rmwCGA-jhgj-mrmf-hh76CGA-jhvq-qfx4-3pjrCGA-jj2h-jhpc-h7jgCGA-jjm2-xfg7-x49fCGA-jpc4-3h3v-c87hCGA-jphf-j766-cvrgCGA-jqfm-92jq-4f26CGA-jx9f-ff69-xpv3CGA-m26p-8q2r-8qmpCGA-m7w7-pp5p-63rrCGA-m988-p7qh-vrf8CGA-mfmw-gjw3-m542CGA-mh4f-83xc-9hwmCGA-mhh3-f38x-5wrhCGA-mhr9-cx5v-vw55CGA-mm4p-pxgc-w45xCGA-mmh5-gjjw-658wCGA-p7vq-2q5m-p7wwCGA-pc33-hww6-m4g6CGA-pg7g-vrmr-m5qjCGA-phwr-wrc7-h9hhCGA-pwpq-wvr5-ccwfCGA-px4w-hxcr-x394CGA-2jqj-j3w9-rc94CGA-4qj4-g8hf-5v35CGA-5wmh-fqgq-9fjpCGA-6gcg-qrr8-mwrmCGA-6jw9-ghm5-xjw8CGA-6vgp-6v42-g84pCGA-7g9x-cwfv-55q5CGA-7vm9-mqc3-75xxCGA-89c8-2cff-j24wCGA-8c5p-mgv5-6j97CGA-8q8v-v25c-fq65CGA-c56c-273w-v9j9CGA-c6mc-vxhc-mcq9CGA-cfx6-9w84-fx39CGA-chxx-rp92-j94jCGA-cqmh-j7f7-gv3jCGA-cv5w-xm3m-mhj9CGA-f2x3-3frg-fvhhCGA-f879-6552-72rcCGA-fmm2-h2r9-9m43CGA-g2p8-r6r3-84gvCGA-g6g3-fmjc-hmxwCGA-g7p9-q3rx-mqcfCGA-gxcp-hxq9-52xcCGA-h7mg-p3hv-98rmCGA-hwg9-8227-gm68CGA-jpmr-636h-qm35CGA-jw2x-44m9-pf4xCGA-m44m-4c93-r994CGA-p8mc-hv64-c5r7CGA-pjhq-hc5h-cmvvCGA-prgm-2rjh-x2jjCGA-q4f5-9r9r-p9qhCGA-q5m2-wm4w-932wCGA-q5rw-gwf2-36c2CGA-q7v4-2g4p-3r6fCGA-q88h-v38p-j3vmCGA-q8xh-w822-pxhvCGA-q992-6v26-4f76CGA-qcq6-6537-gq6vCGA-qffg-x5qw-9275CGA-qg76-q2hc-5rmxCGA-qh22-2jmp-74xpCGA-qh96-mq3c-pg9cCGA-qhvx-mf4v-2p53CGA-qjc8-44jh-4g95CGA-qjwp-6r4q-cp2gCGA-qprh-c74c-fh26CGA-qq6q-mp9q-hvr7CGA-qqpp-2cf6-qf9vCGA-qvc3-2hvr-x5cjCGA-r27m-hv85-7q9cCGA-r3r9-59v2-rj72CGA-r49v-f2v8-hrggCGA-r75r-j84h-4vf5CGA-rfx2-8gmc-f9fpCGA-rm6p-rrvv-99xvCGA-rwv7-j98c-x6rpCGA-v39h-vw6g-cr58CGA-v3v3-rc7f-x5vmCGA-v5gc-m37p-xm86CGA-v5gg-2gmw-r7cpCGA-v7hw-rj6v-pg2pCGA-v85x-cjc6-mx58CGA-v872-947m-w7v8CGA-v953-h6vw-wgp3CGA-vffp-h67w-fvw9CGA-vfqr-jj3h-2wrrCGA-vg6h-qvpj-m2f4CGA-vg7g-rgvq-6x76CGA-vgwg-x965-q997CGA-vh55-79w3-3w56CGA-vh8x-qj33-fr3jCGA-vmh6-8qm4-3j6cCGA-vmv8-h32g-qrj8CGA-vmxm-8c69-pvf6CGA-vq34-hjx3-pwvpCGA-vqp2-4qq3-6h3jCGA-vv3m-cgcf-8cfrCGA-vw9m-g48m-92f8CGA-vwh3-47h2-g3rmCGA-w46v-wggh-j79cCGA-w6j9-c79c-3ffrCGA-w6qq-vqcc-jpr6CGA-w7h2-p695-crhjCGA-w8f5-m257-4f56CGA-w9p7-gr7m-g8rjCGA-wcjp-7cf2-cm9jCGA-wf93-4646-8v75CGA-wj4j-j8pq-2c72CGA-wjvx-55j8-9jwhCGA-wm4v-9r3g-5535CGA-wmhg-83q5-q2mxCGA-wq33-cxwv-m2gpCGA-wx84-c23h-22f9CGA-wxpf-674w-6g5jCGA-x3hr-4pr6-8cv8CGA-x42h-r3f3-39hfCGA-x469-9jfv-qvprCGA-x5fc-f7mg-cjxgCGA-x6gj-qhpg-3pg8CGA-x6hc-p43x-rx4qCGA-x777-6q6j-v435CGA-x94v-2hrp-h256CGA-x9m6-c5mh-7w8qCGA-xf5q-c3rg-w6xxCGA-xfm2-v946-mvr5CGA-xjcm-2wvq-v4crCGA-xq7x-w92h-7xr7CGA-xv79-v899-rxw4CGA-xxq9-f7xc-97c4
Advisory lineage Upstream: 0 Downstream: 29
Deferred
Published: 09 Jun 2025, 17:57
Last modified:09 Jun 2025, 18:40
Vulnerability Summary
Overall Risk (default)
low
21/100 CVSS Score
5.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.98% LOW
1% probability +0.88%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
09 Jun 2025, 17:57
Published
Vulnerability first disclosed
09 Jun 2025, 18:40
Last Modified
Vulnerability information updated
Description
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
CVSS Metrics
- v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Trends
Current EPSS score: 0.98%• Percentile: 61%
Techniques & Countermeasures
- CWE-522•Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected Systems
- alpine•py3-requests
< 2.32.4-r0 | < 2.32.4-r0 | < 2.32.4-r0 | < 2.32.4-r0 | < 2.32.4-r0 | < 2.32.4-r0
- chainguard•airflow
all
- chainguard•airflow-3
< 3.0.1-r1
- chainguard•airflow-3-bitnami-compat
< 3.0.1-r1
- chainguard•airflow-3-compat
< 3.0.1-r1
- chainguard•airflow-3-iamguarded-compat
< 3.0.1-r1
- chainguard•airflow-bitnami-compat
all
- chainguard•airflow-core-2
< 2.11.0-r2
- chainguard•airflow-core-2-compat
< 2.11.0-r2
- chainguard•airflow-core-2-oci-entrypoint
< 2.11.0-r2
- chainguard•airflow-core-3
< 3.0.2-r0
- chainguard•airflow-core-3-compat
< 3.0.2-r0
- chainguard•airflow-core-3-oci-entrypoint
< 3.0.2-r0
- chainguard•apache-beam-python-3.11-sdk
< 2.65.0-r1
- chainguard•awx
< 0
- chainguard•az
< 2.74.0-r1
- chainguard•az-iamguarded-compat
< 2.74.0-r1
- chainguard•barman
< 3.14.0-r1
- chainguard•barman-cloudnative-pg
< 3.14.0-r1
- chainguard•confluent-docker-utils
< 0.0.162-r0
- chainguard•dask-gateway
< 2025.4.0-r2
- chainguard•dask-gateway-server
< 2025.4.0-r2
- chainguard•dask-kubernetes
< 0
- chainguard•emissary
< 3.10.0-r5
- chainguard•emissary-apiext
< 3.10.0-r5
- chainguard•emissary-oci-entrypoint
< 3.10.0-r5
- chainguard•ggshield
< 1.40.0-r1
- chainguard•graalvm-24-graalpy-venv
all
- chainguard•graalvm-25-graalpy-venv
< 25.0.2-r10
- chainguard•jupyter-base-notebook
< 7.4.3-r1
- chainguard•jupyter-docker-base
all
- chainguard•jupyter-docker-stacks
all | < 7.3.2-r1
- chainguard•jwt-tool
< 2.3.0-r1
- chainguard•k8s-sidecar
< 1.30.3-r1
- chainguard•katib-controller
< 0.18.0-r6
- chainguard•katib-controller-compat
< 0.18.0-r6
- chainguard•katib-db-manager
< 0.18.0-r6
- chainguard•katib-db-manager-compat
< 0.18.0-r6
- chainguard•katib-earlystopping
< 0.18.0-r6
- chainguard•katib-file-metricscollector
< 0.18.0-r6
- chainguard•katib-file-metricscollector-compat
< 0.18.0-r6
- chainguard•katib-suggestion-goptuna
< 0.18.0-r6
- chainguard•katib-suggestion-goptuna-compat
< 0.18.0-r6
- chainguard•katib-suggestion-hyperband
< 0.18.0-r6
- chainguard•katib-suggestion-hyperopt
< 0.18.0-r6
- chainguard•katib-suggestion-nas-darts
< 0.18.0-r6
- chainguard•katib-suggestion-nas-enas
< 0.18.0-r6
- chainguard•katib-suggestion-optuna-enas
< 0.18.0-r6
- chainguard•katib-suggestion-pbt-enas
< 0.18.0-r6
- chainguard•katib-suggestion-skopt-enas
< 0.18.0-r6
Showing first 50 affected entries in server-rendered view.
References (51)
- https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7
- https://github.com/psf/requests/pull/6965
- https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef
- https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env
- https://seclists.org/fulldisclosure/2025/Jun/2
- http://seclists.org/fulldisclosure/2025/Jun/2
- http://www.openwall.com/lists/oss-security/2025/06/03/9
- http://www.openwall.com/lists/oss-security/2025/06/03/11
- http://www.openwall.com/lists/oss-security/2025/06/04/1
- http://www.openwall.com/lists/oss-security/2025/06/04/6
- https://nvd.nist.gov/vuln/detail/CVE-2024-47081
- https://github.com/psf/requests
- https://pypi.org/project/requests
- https://github.com/advisories/GHSA-9hjg-9r4m-mvj7
- https://security-tracker.debian.org/tracker/CVE-2024-47081
- https://access.redhat.com/errata/RHSA-2025:12519
- https://access.redhat.com/security/updates/classification/#moderate
- https://bugzilla.redhat.com/show_bug.cgi?id=2371272
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12519.json
- https://access.redhat.com/security/cve/CVE-2024-47081
- https://www.cve.org/CVERecord?id=CVE-2024-47081
- https://access.redhat.com/errata/RHSA-2025:13234
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13234.json
- https://access.redhat.com/errata/RHSA-2025:13604
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13604.json
- https://access.redhat.com/errata/RHSA-2025:14750
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14750.json
- https://access.redhat.com/errata/RHSA-2025:14999
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14999.json
- https://access.redhat.com/errata/RHSA-2025:15121
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15121.json
- https://access.redhat.com/errata/RHSA-2025:15122
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15122.json
- https://access.redhat.com/errata/RHSA-2025:15614
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15614.json
- https://access.redhat.com/errata/RHSA-2025:15615
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15615.json
- https://access.redhat.com/errata/RHSA-2025:15616
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15616.json
- https://access.redhat.com/errata/RHSA-2025:15617
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15617.json
- https://access.redhat.com/errata/RHSA-2025:15618
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15618.json
- https://access.redhat.com/errata/RHSA-2025:15622
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15622.json
- https://access.redhat.com/errata/RHSA-2025:15691
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15691.json
- https://access.redhat.com/errata/RHSA-2025:15723
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15723.json
- https://security.alpinelinux.org/vuln/CVE-2024-47081
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47081.json