CVE-2018-18074: Vulnerability in requests package
Summary
CVE-2018-18074: The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by... Affects requests across 2 version ranges.
< 2.20.0
< c45d7c49ea75133e52ab22a8e9e13173938e36ff
Fixed in c45d7c49ea75133e52ab22a8e9e13173938e36ff. How to fix ↓
Also tracked for
- requests · Debian:11
The same CVE-2018-18074 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requests package is a popular Python library used for making HTTP requests. It provides a simple and intuitive API for sending HTTP/1.1 requests. The package is widely used in various Python applications and frameworks to interact with web services and APIs. However, versions before 2.20.0 of the requests package are vulnerable to a security issue.
Vulnerability Detail
The vulnerability (CVE-2018-18074) in the requests package allows an attacker to discover credentials by sniffing the network. When the package receives a same-hostname HTTPS-to-HTTP redirect, it sends an HTTP Authorization header to the HTTP URI. This behavior makes it easier for remote attackers to intercept and obtain sensitive credentials. The vulnerability was identified on October 9, 2018, and affects versions prior to 2.20.0 of the requests package.
How To Fix
Latest published version: 2.34.2 as of 22 Oct 2026
pip install --upgrade "requests==2.34.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
c45d7c49ea75133e52ab22a8e9e13173938e36ff
This is the first release that contains the fix.
pip install --upgrade "requests==c45d7c49ea75133e52ab22a8e9e13173938e36ff"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the requests package is not immediately feasible, a possible workaround is to manually modify the code to avoid sending the Authorization header in the described scenario. Here's an example of how to achieve this:
import requests
session = requests.Session()
Disable sending Authorization header on HTTPS-to-HTTP redirect
session.trust_env = False
Make requests using the session object
response = session.get('http://example.com')
Conclusion
The vulnerability in the requests package (CVE-2018-18074) allows remote attackers to discover credentials by sniffing the network. It is crucial to upgrade to version 2.20.0 or later of the requests package to mitigate this vulnerability. If immediate upgrade is not possible, the provided workaround can be implemented. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for requests →
FAQ
The vulnerability allows remote attackers to intercept and obtain credentials by sniffing the network. This can lead to unauthorized access to sensitive information and potential compromise of user accounts.
Versions prior to 2.20.0 of the requests package are affected by this vulnerability.
While there is no specific known exploit available, the vulnerability can be exploited by attackers with network access and the ability to intercept HTTP traffic.
Yes, the vulnerability has been fixed in version 2.20.0 of the requests package.
The recommended mitigation is to upgrade the requests package to version 2.20.0 or later. If immediate upgrade is not possible, the provided workaround can be implemented to avoid sending the Authorization header in the vulnerable scenario.
References
Related vulnerabilities
Recent vulnerabilities recorded for requests.
