{"items":[{"id":"NVI-00015395","kind":"vulnerability","title":"Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-76g3-c3x4-crvx","CVE-2026-84366"],"plain_summary":"GitHub lists this reviewed advisory for scrapy. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-63e6385c0f027004386dc96f6c4bba64"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-02T22:50:45.000Z","value":"7.4 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-63e6385c0f027004386dc96f6c4bba64"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-63e6385c0f027004386dc96f6c4bba64","url":"https://github.com/advisories/GHSA-76g3-c3x4-crvx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-76g3-c3x4-crvx","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:29.477Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-63e6385c0f027004386dc96f6c4bba64"],"technology":"scrapy","known_exclusions":[],"conditions_summary":"### Problem\n\nScrapy’s `S3DownloadHandler` sends signed S3 requests over plaintext HTTP by default.\n\nA normal request like `s3://bucket/key` is converted into `http://bucket.s3.amazonaws.com/key` unless `request.meta[\"is_secure\"]` is explicitly set. The generated request is then signed with configured AWS credentials, so AWS authorization material can be sent without TLS.\n\nVulnerable code in `scrapy/core/downloader/handlers/s3.py`:\n\n```python\nscheme = \"https\" if request.meta.get(\"is_secure\") else \"http\"\nurl = f\"{scheme}://{bucket}.s3.amazonaws.com{path}\"\n```\n\nThe request is then signed and dispatched:\n\n```python\nself._signer.add_auth(awsrequest)\nrequest = request.replace(url=url, headers=awsrequest.headers.items())\n```\n\n### Impact\n\nUsers making Scrapy `s3://` requests with AWS credentials are impacted.\n\nA network attacker able to observe traffic between Scrapy and S3, such as a public Wi-Fi attacker, compromised router, ISP/corporate network observer, or local network attacker using ARP spoofing, can read:\n\n```text\nbucket/key path\nAWS Authorization header\nX-Amz-Security-Token, if temporary credentials are used\nS3 object contents\nS3 response headers\n```\n\nAn active MITM attacker can a","public_affected_ranges":["< 2.17.0"]}],"null_published_at":"2026-11-03T10:03:31.362Z","source_updated_at":"2026-09-02T22:50:45.000Z","source_disclosed_at":"2026-09-02T22:50:44.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:21:29.477Z"}],"next_cursor":null,"snapshot_revision":"42594"}