GHSA-76G3-C3X4-CRVX Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

Problem Scrapy’s S3DownloadHandler sends signed S3 requests over plaintext HTTP by default. A normal request like s3://bucket/key is converted into http://bucket.s3.amazonaws.com/key unless request.meta"issecure" is explicitly set. The generated request is then signed with configured AWS...

DEBIAN-CVE-2026-84366

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta"issecure" is...

CVE-2026-84366

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta"issecure" is...

CVE-2026-84366 Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta"issecure" is...

CVE-2026-84366

Scrapy's S3DownloadHandler (in scrapy/core/downloader/handlers/s3.py) converts S3-scheme requests into plaintext HTTP requests to S3 endpoints unless request.meta["is_secure"] is explicitly enabled. Prior to version 2.17.0 , the request is signed and sent in cleartext with the configured AWS cred...