Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-requestsUpgrade python3-requests+securityUpgrade python3-requests+socks | Jan 7, 2025 | May 20, 2024 |
| Alpine Linux | — | Upgrade py3-requests | Aug 22, 2024 | May 20, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python38-pipUpgrade python-requestsUpgrade python3-pipUpgrade python-pip-wheelUpgrade python3-requestsUpgrade python2-pipUpgrade aws-cfn-bootstrap | Oct 17, 2024 | May 20, 2024 |
| Debian | — | No solution existsUpgrade requests | May 15, 2025 | May 20, 2024 |
| Dell Powerstore Dsa2025086 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Feb 20, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-requests | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade python3-requestsUpgrade python3-requests+securityUpgrade python3-requests+socks | Jan 3, 2025 | May 20, 2024 |
| Redhat_linux | — | Upgrade python3-requests+socksUpgrade python3-requestsNo solution existsUpgrade python3-requests+security | Jan 6, 2025 | May 20, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.6Upgrade Splunk Enterprise to version 9.3.1Upgrade Splunk Enterprise to version 9.2.3 | Sep 30, 2025 | May 20, 2024 |
| Suse | — | Upgrade python-requestsUpgrade python3-requestsUpgrade python313-requestsUpgrade python311-requestsUpgrade python3-dockerUpgrade python311-docker | May 31, 2024 | May 20, 2024 |
| Ubuntu | — | Upgrade python3-pip (Ubuntu Pro)Upgrade python3-pip-whl (Ubuntu Pro) | Nov 19, 2024 | May 20, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub