Does Python requests 2.25.0 have known vulnerabilities?

Answered byPackage Vulnerability Check API: CVEs, CISA KEV, safe upgrade

Price$0.005 per package version or CVE answered (HTTP API)

StatusOn the HTTP API

Yes. OSV.dev lists several moderate advisories for requests 2.25.0, among them CVE-2023-32681 (Proxy-Authorization header leak, fixed in 2.31.0) and CVE-2024-35195 (fixed in 2.32.0); none is in CISA's KEV catalog. safe_version names the lowest release that clears them all, and each advisory links to osv.dev.

Tool input

{
  "ecosystem": "PyPI",
  "name": "requests",
  "version": "2.25.0"
}

Ask it from an AI agent (MCP)

Add the Apify MCP server with this tool to your MCP client (Claude, Cursor, VS Code, ...); it signs you in with OAuth or Authorization: Bearer <APIFY_TOKEN>. It works once the Actor is listed on the Apify Store; until then use the HTTP API or the remote MCP server at https://api.boscolabs.dev/mcp.

https://mcp.apify.com?tools=bosco_labs/package-vulns

Then ask:

Use the bosco_labs/package-vulns tool to answer: Does Python requests 2.25.0 have known vulnerabilities?

Call the Apify API

Runs the Actor and returns the rows in one request, billed to your Apify account ($0.005 per package version or CVE answered (HTTP API)). It works once the Actor is listed on the Apify Store; until then use the HTTP API or the remote MCP server at https://api.boscolabs.dev/mcp.

curl https://api.apify.com/v2/acts/bosco_labs~package-vulns/run-sync-get-dataset-items \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ecosystem": "PyPI", "name": "requests", "version": "2.25.0"}'

Call the Bosco Labs HTTP API

Bosco Labs HTTP API (beta): same input and rows, $0.005 per package version or CVE answered from prepaid credits. Get a key with a $0.50 free trial, or send the same call without a key and pay per call in USDC via x402 (no account).

curl https://api.boscolabs.dev/v1/package-vulns \
  -H "Authorization: Bearer $BOSCO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ecosystem": "PyPI", "name": "requests", "version": "2.25.0"}'

Example output

Snapshot taken 2026-11-06, source links in each row. First 1 of 1 rows (snapshot runs stop at 5 rows); long values shortened.

[
  {
    "schema_version": "1",
    "query_type": "package",
    "ecosystem": "PyPI",
    "name": "requests",
    "version": "2.25.0",
    "vulnerability_id": null,
    "summary": "PyPI requests 2.25.0: 4 known vulnerabilities (max severity MODERATE), none in CISA KEV; safe version: 2.33.0.",
    "vulnerability_count": 4,
    "known_exploited": false,
    "max_severity": "MODERATE",
    "safe_version": "2.33.0",
    "safe_version_note": "2.33.0 is the lowest version above 2.25.0 among the advisories' fixed versions with no known vulnerability in OSV.dev (checked with OSV, not a release-list s...",
    "epss": null,
    "nvd": null,
    "...": "6 more fields"
  }
]

Call it on the HTTP API →All fields and limits