{"id":"CVE-2024-1968","aliases":["GHSA-4qqq-9vqf-3h3f","PYSEC-2024-258"],"url":"https://o3.security/vulnerability/CVE-2024-1968","summary":"Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects","details":"### Impact\n\nSince version 2.11.1, Scrapy drops the `Authorization` header when a request is redirected to a different domain. However, it keeps the header if the domain remains the same but the scheme (http/https) or the port change, all scenarios where the header should also be dropped.\n\nIn the context of a man-in-the-middle attack, this could be used to get access to the value of that `Authorization` header\n\n### Patches\n\nUpgrade to Scrapy 2.11.2.\n\n### Workarounds\n\nThere is no easy workaround for unpatched versions of Scrapy. You can replace the built-in redirect middlewares with custom ones patched for this issue, but you have to patch them yourself, manually.\n\n### References\n\nThis security issue was reported and fixed by @szarny at https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a/.\n","published":"2024-05-20T08:03:43.129Z","modified":"2026-08-12T03:51:32.464178372Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"scrapy","fixedVersion":"2.11.2"}],"fix":{"url":"https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8","label":"scrapy/scrapy@1d0502f"},"references":[{"type":"WEB","url":"https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1968.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1968"},{"type":"FIX","url":"https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8"},{"type":"WEB","url":"https://github.com/scrapy/scrapy/security/advisories/GHSA-4qqq-9vqf-3h3f"},{"type":"PACKAGE","url":"https://github.com/scrapy/scrapy"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:32.464178372Z"}}