THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-76g3-c3x4-crvx (high) — Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

[GHSA] GHSA-76g3-c3x4-crvx (high) — Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

medgithub_advisoriesPublished 2026-09-02

GHSA-76g3-c3x4-crvx Severity: high CVE: CVE-2026-84366

Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

### Problem

Scrapy’s `S3DownloadHandler` sends signed S3 requests over plaintext HTTP by default.

A normal request like `s3://bucket/key` is converted into `http://bucket.s3.amazonaws.com/key` unless `request.meta["is_secure"]` is explicitly set. The generate

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-76g3-c3x4-crvx