GHSA-9x8m-2xpf-crp3
Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another
GHSA-9x8m-2xpf-crp3 is a vulnerability with no CVSS score yet in scrapy, published July 29, 2022. No source lists public exploit code. Fixed in scrapy 1.8.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.8.3scrapy +3 more
Description
Impact
When the built-in HTTP proxy downloader middleware processes a request with proxy metadata, and that proxy metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the Proxy-Authentication header, but only if that header is not already set.
There are third-party proxy-rotation downloader middlewares that set different proxy metadata every time they process a request.
Because of request retries and redirects, the same request can be processed by downloader middlewares more than once, including both the built-in HTTP proxy downloader middleware and any third-party proxy-rotation downloader middleware.
These third-party proxy-rotation downloader middlewares could change the proxy metadata of a request to a new value, but fail to remove the Proxy-Authentication header from the previous value of the proxy metadata, causing the credentials of one proxy to be leaked to a different proxy.
If you rotate proxies from different proxy providers, and any of those proxies requires credentials, you are affected, unless you are handling proxy rotation as described under Workarounds below. If you use a third-party downloader middleware for proxy rotation, the same applies to that downloader middleware, and installing a patched version of Scrapy may not be enough; patching that downloader middlware may be necessary as well.
Patches
Upgrade to Scrapy 2.6.2.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.2 is not an option, you may upgrade to Scrapy 1.8.3 instead.
Workarounds
If you cannot upgrade, make sure that any code that changes the value of the proxy request meta also removes the Proxy-Authorization header from the request if present.
For more information
If you have any questions or comments about this advisory:
- Open an issue
- Email us
Affected packages
| Package | Affected | Fixed |
|---|---|---|
scrapyPyPI | before 1.8.3 | 1.8.3 |
scrapyPyPI | 2.0.0 up to 2.6.2 | 2.6.2 |
scrapyPyPI | before 1.8.3, plus listed versions 0.10.4.23640.12.0.25500.14.10.14.20.14.3 Show 45 moreShow less0.14.40.16.00.16.10.16.20.16.30.16.40.16.50.18.00.18.10.18.20.18.30.18.40.20.00.20.10.20.20.22.00.22.10.22.20.24.00.24.10.24.20.24.30.24.40.24.50.24.60.70.80.91.0.01.0.0rc11.0.0rc21.0.0rc31.0.11.0.21.0.31.0.41.0.51.0.61.0.71.1.01.1.0rc11.1.0rc21.1.0rc31.1.0rc41.1.1 | 1.8.3 |
scrapyPyPI | 2.0.0 up to 2.6.2, plus listed versions 2.0.12.1.02.2.02.2.12.3.0 Show 6 moreShow less2.4.02.4.12.5.02.5.12.6.02.6.1 | 2.6.2 |
What each source reports
GitHub AdvisoriesNo score
Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another
Impact
When the built-in HTTP proxy downloader middleware processes a request with proxy metadata, and that proxy metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the Proxy-Authentication header, but only if that header is not already set.
There are third-party proxy-rotation downloader middlewares that set different proxy metadata every time they process a request.
Because of request retries and redirects, the same request can be processed by downloader middlewares more than once, including both the built-in HTTP proxy downloader middleware and any third-party proxy-rotation downloader middleware.
These third-party proxy-rotation downloader middlewares could change the proxy metadata of a request to a new value, but fail to remove the Proxy-Authentication header from the previous value of the proxy metadata, causing the credentials of one proxy to be leaked to a different proxy.
If you rotate proxies from different proxy providers, and any of those proxies requires credentials, you are affected, unless you are handling proxy rotation as described under Workarounds below. If you use a third-party downloader middleware for proxy rotation, the same applies to that downloader middleware, and installing a patched version of Scrapy may not be enough; patching that downloader middlware may be necessary as well.
Patches
Upgrade to Scrapy 2.6.2.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.2 is not an option, you may upgrade to Scrapy 1.8.3 instead.
Workarounds
If you cannot upgrade, make sure that any code that changes the value of the proxy request meta also removes the Proxy-Authorization header from the request if present.
For more information
If you have any questions or comments about this advisory:
- Open an issue
- Email us
- Record
GHSA-9x8m-2xpf-crp3- Updated
- 2026-11-02
OSVNo score
Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another
Impact
When the built-in HTTP proxy downloader middleware processes a request with proxy metadata, and that proxy metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the Proxy-Authentication header, but only if that header is not already set.
There are third-party proxy-rotation downloader middlewares that set different proxy metadata every time they process a request.
Because of request retries and redirects, the same request can be processed by downloader middlewares more than once, including both the built-in HTTP proxy downloader middleware and any third-party proxy-rotation downloader middleware.
These third-party proxy-rotation downloader middlewares could change the proxy metadata of a request to a new value, but fail to remove the Proxy-Authentication header from the previous value of the proxy metadata, causing the credentials of one proxy to be leaked to a different proxy.
If you rotate proxies from different proxy providers, and any of those proxies requires credentials, you are affected, unless you are handling proxy rotation as described under Workarounds below. If you use a third-party downloader middleware for proxy rotation, the same applies to that downloader middleware, and installing a patched version of Scrapy may not be enough; patching that downloader middlware may be necessary as well.
Patches
Upgrade to Scrapy 2.6.2.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.2 is not an option, you may upgrade to Scrapy 1.8.3 instead.
Workarounds
If you cannot upgrade, make sure that any code that changes the value of the proxy request meta also removes the Proxy-Authorization header from the request if present.
For more information
If you have any questions or comments about this advisory:
- Open an issue
- Email us
- Record
GHSA-9x8m-2xpf-crp3- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 24 versions. The JSON record has them.