Requests (Python) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 161 known versions, newest CVE from 2026-03-25. Vendor: Python.

CVEs of Requests

• CVE-2026-25645 - CVSS 5.5 (medium), 2026-03-25: Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting…
• CVE-2023-32681 - CVSS 6.1 (medium), 2023-05-26: Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS…
• CVE-2018-18074 - CVSS 7.5 (high), 2018-10-09: The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which…
• CVE-2015-2296 - CVSS 6.8 (medium), 2015-03-18: The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without…
• CVE-2014-1830 - CVSS 5 (medium), 2014-10-15: Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected…
• CVE-2014-1829 - CVSS 5 (medium), 2014-10-15: Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.