Scrapy versions from 2.9.0 up to but not including 2.11.2 have a vulnerability where redirects do not properly switch proxy settings based on URL scheme changes (HTTP to HTTPS or vice versa). This causes the proxy configured for one scheme to be incorrectly used for the other, potentially leaking browsing information between proxies. The issue is fixed in Scrapy 2.11.2.