{"action":"Upgrade scrapy to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"},{"fixed":"2.11.2","introduced":"2.0.0"}],"component":"scrapy","cve_ids":["CVE-2024-1968"],"ecosystem":"PyPI","epss":0.00688,"exploited":false,"fixed_versions":["2.0.0","2.11.2"],"ghsa_id":"GHSA-4qqq-9vqf-3h3f","id":"tcs_01M5KGMSBK09KW0J3PDYNGAHJK","modified_at":"2026-06-10T17:02:40.010041244Z","published_at":"2024-05-20T08:15:08Z","references":["https://osv.dev/vulnerability/PYSEC-2024-258","https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a","https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8","https://github.com/advisories/GHSA-4qqq-9vqf-3h3f"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2024-258","url":"https://osv.dev/vulnerability/PYSEC-2024-258"}],"summary":"In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behav"}