Only the latest release of pyreqwest receives security fixes.

Do not open a public issue for security vulnerabilities.

Use the Report a vulnerability button on the GitHub Security tab.

pyreqwest is a Python binding over reqwest (Rust) using rustls for TLS. The security surface includes:

• TLS/certificate validation — handled by rustls; issues in rustls or webpki should be reported upstream
• reqwest — HTTP client vulnerabilities (redirects, header injection, SSRF) should be reported upstream to the reqwest repository
• pyreqwest binding layer — memory safety, Python/Rust boundary issues, incorrect exposure of reqwest behavior

• Vulnerabilities in Python itself or PyO3
• Issues in dependencies that have no published CVE or upstream fix
• Denial of service via resource exhaustion from user-controlled inputs (caller's responsibility)