Executive brief
Scrapy authorization header leakage on cross-domain redirect
Affected products
- PyPI scrapy
Junglewise Threat Intelligence
CVE-2024-3574: PYSEC-2026-1908 - Scrapy authorization header leakage on cross-domain redirect
CVE-2024-3574 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: scrapy (PyPI). Vendors: PyPI.
Related threats
- Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S
- PYSEC-2026-2401 - Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation
- PYSEC-2026-1907 - Scrapy decompression bomb vulnerability
- PYSEC-2024-258 - In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g.
- PYSEC-2024-162 - A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in