CVE-2014-1830: Vulnerability in requests package
Summary
CVE-2014-1830: Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request. Affects requests versions < 2.3.0. Fixed in 2.3.0. How to fix ↓
Also tracked for
- requests · Debian:11
The same CVE-2014-1830 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requests package, also known as python-requests, is a popular library in the Python ecosystem used for making HTTP requests. It provides a convenient interface for sending HTTP/1.1 requests and handling responses. However, versions before 2.3.0 are susceptible to a security vulnerability.
Vulnerability Detail
The vulnerability (CVE-2014-1830) in requests allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request. This means that an attacker could potentially intercept and access sensitive data transmitted through the Proxy-Authorization header, leading to unauthorized access or data leakage.
How To Fix
Latest published version: 2.34.2 as of 22 Oct 2026
pip install --upgrade "requests==2.34.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
pip install --upgrade "requests==2.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to avoid using the Proxy-Authorization header in requests or to disable proxy usage altogether. Here's an example of how to disable proxy usage in requests:
import requests
requests.get('https://example.com', proxies={})
Conclusion
In conclusion, the requests package before version 2.3.0 is vulnerable to CVE-2014-1830, which allows remote servers to obtain sensitive information. It is crucial to upgrade to the latest version or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for requests →
FAQ
The vulnerability allows remote servers to access sensitive information, potentially leading to unauthorized access or data leakage.
Versions before 2.3.0 are affected by this vulnerability.
Yes, you can temporarily disable proxy usage or avoid using the Proxy-Authorization header in requests.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and it will analyze and alert you in real-time.
You can find more information about this vulnerability in the advisory database maintained by the Python Packaging Authority (PyPA). Here is the source: https://github.com/pypa/advisory-database/blob/main/vulns/requests/PYSEC-2014-14.yaml
Related vulnerabilities
Recent vulnerabilities recorded for requests.
