CVE-2014-1830: Vulnerability in requests package allows sensitive information disclosure
Summary
CVE-2014-1830: Exposure of Sensitive Information to an Unauthorized Actor in Requests. Affects requests versions < 2.3.0. Fixed in 2.3.0. How to fix ↓
Also tracked for
- requests · Debian:11
The same CVE-2014-1830 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requests package, also known as python-requests, is a popular Python library used for making HTTP requests. It provides a convenient and user-friendly interface for sending HTTP requests and handling responses. The package is widely used in various Python applications and frameworks. However, versions before 2.3.0 of the requests package are vulnerable to a security issue that can lead to the disclosure of sensitive information.
Vulnerability Detail
The vulnerability (CVE-2014-1830) in the requests package allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request. This means that an attacker-controlled server could potentially intercept and read sensitive data, such as authentication credentials, sent by the client application. This can result in unauthorized access to sensitive resources and compromise the security of the system.
How To Fix
Latest published version: 2.34.2 as of 22 Oct 2026
pip install --upgrade "requests==2.34.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
pip install --upgrade "requests==2.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the requests package is not immediately feasible, a temporary workaround is to avoid using the Proxy-Authorization header in requests or to disable proxy usage altogether. This can be achieved by modifying the code that makes HTTP requests and removing any references to the Proxy-Authorization header. However, this workaround may not be suitable for all scenarios and upgrading to a fixed version is strongly recommended.
Conclusion
The vulnerability in the requests package (CVE-2014-1830) can lead to the disclosure of sensitive information, potentially compromising the security of the system. It is crucial to upgrade to version 2.3.0 or later of the requests package to fix this vulnerability. If immediate upgrading is not possible, consider implementing the provided workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for requests →
FAQ
The vulnerability allows remote servers to obtain sensitive information, potentially leading to unauthorized access and compromise of the system.
Versions before 2.3.0 of the requests package are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file and the playground will analyze it for any open-source vulnerabilities, including this one.
Yes, upgrading the requests package to version 2.3.0 or later will fix this vulnerability.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly. However, it is important to address this vulnerability promptly to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for requests.
