CVE-2022-24737: Exposure of Sensitive Information in HTTPie
Summary
CVE-2022-24737: Exposure of Sensitive Information to an Unauthorized Actor in httpie. Affects httpie versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Also tracked for
- httpie · Debian:11
The same CVE-2022-24737 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HTTPie is a command-line tool for making HTTP requests. It allows users to persistently store request and response state using sessions. Sessions can store authentication data, cookies, and other information. This vulnerability in HTTPie versions prior to 3.1.0 exposes sensitive information stored in sessions to unauthorized actors. Specifically, cookies were not properly associated with the hosts they belonged to, resulting in the exposure of cookies when there are redirects to third-party websites. This vulnerability has a CVSS score of 6.5.
Vulnerability Detail
The vulnerability in HTTPie allows an unauthorized actor to access sensitive information stored in sessions. When a response contains a Set-Cookie header, HTTPie parses it and stores the cookie in the session. However, prior to version 3.1.0, HTTPie did not properly associate cookies with the hosts they belonged to. This means that when there are redirects to third-party websites, cookies associated with the original host may be exposed. An attacker could exploit this vulnerability to gain unauthorized access to sensitive information stored in cookies, potentially leading to further attacks or unauthorized account access.
How To Fix
Latest published version: 3.2.4 as of 22 Oct 2026
pip install --upgrade "httpie==3.2.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.0
This is the first release that contains the fix.
pip install --upgrade "httpie==3.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. Upgrading to HTTPie version 3.1.0 or higher is the recommended solution.
Conclusion
The vulnerability in HTTPie versions prior to 3.1.0 exposes sensitive information stored in sessions to unauthorized actors. Upgrading to version 3.1.0 or higher and running the httpie cli sessions upgrade command on sessions will fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for httpie →
FAQ
HTTPie is a command-line tool for making HTTP requests. It provides a user-friendly interface for interacting with APIs and web services.
Sessions in HTTPie allow users to persistently store request and response state. This can include authentication data, cookies, and other information.
The vulnerability in HTTPie exposes sensitive information by not properly associating cookies with the hosts they belong to. This allows cookies to be exposed when there are redirects to third-party websites.
The impact of this vulnerability is the potential exposure of sensitive information stored in cookies. This information could be used by attackers to gain unauthorized access to user accounts or perform further attacks.
To fix this vulnerability, upgrade your HTTPie version to 3.1.0 or higher and run the httpie cli sessions upgrade command on your sessions.
References
Related vulnerabilities
Recent vulnerabilities recorded for httpie.
