CVE-2024-1968: Scrapy Authorization Header Exposure During Redirects
Summary
CVE-2024-1968: In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. Affects scrapy across 3 version ranges.
< 1d0502f25bbe55a22899af915623fda1aaeb9dd8
< 2.0.0
>= 2.0.0, < 2.11.2
Fixed in 2.0.0 or 2.11.2, depending on the release line you run. How to fix ↓
Also tracked for
- python-scrapy · Debian:11
The same CVE-2024-1968 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Scrapy is a powerful open-source web crawling and web scraping framework for Python, designed to extract data from websites efficiently. It provides tools for handling requests, processing responses, and managing data pipelines. However, a vulnerability has been identified in Scrapy that affects its handling of Authorization headers during redirects, particularly when transitioning from HTTPS to HTTP.
Vulnerability Detail
In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the _build_redirect_request function of the redirect middleware.
How To Fix
Latest published version: 2.19.0 as of 22 Oct 2026
pip install --upgrade "scrapy==2.19.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.0.02.0.0pip install --upgrade "scrapy==2.0.0" -
>= 2.0.0, < 2.11.22.11.2pip install --upgrade "scrapy==2.11.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can manually remove the Authorization header from requests before they are sent. This can be done by modifying the request middleware to filter out the Authorization header during redirects.
Conclusion
The CVE-2024-1968 vulnerability in Scrapy poses a significant risk by exposing sensitive Authorization headers during certain redirects. It is crucial for users to upgrade to the patched versions to mitigate this risk. Additionally, utilizing Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for scrapy →
FAQ
The vulnerability can lead to the exposure of sensitive information contained in the Authorization header when a redirect occurs from HTTPS to HTTP.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
All versions of Scrapy prior to the fixed versions are affected, specifically those before 1d0502f25bbe55a22899af915623fda1aaeb9dd8 and 2.11.2.
Yes, you can implement a middleware to strip the Authorization header from requests during redirects as a temporary measure.
If immediate upgrading is not possible, implement the workaround to remove the Authorization header during redirects until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for scrapy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
