Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

urllib3 may let HTTPS proxy ignore TLS settings

CVE-2026-97687 · published 12 days ago
Summary

Versions of the urllib3 Python library from 1.26.0 through 2.7.x can mix up security settings for the target server and the HTTPS proxy. This can cause the proxy connection to skip certificate checks, allowing a malicious proxy to watch or change the data passing through. Upgrade urllib3 to version 2.8.0 or later to keep proxy and server TLS checks separate.

What to do
  • Update debian python-urllib3 to version 2.8.0-1.
  • Update andrey petrov urllib3 to version 2.8.0.
  • Update urllib3 to version 1.26.18+aikido.5.
  • Update urllib3 to version 2.7.0+aikido.1.
  • Update urllib3 to version 1.26.12+aikido.6.
  • Update urllib3 to version 2.6.3+aikido.3.
  • Update urllib3 to version 2.6.2+aikido.4.
  • Update urllib3 to version 1.26.14+aikido.10.
  • Update urllib3 to version 1.26.7+aikido.7.
  • Update urllib3 to version 1.26.13+aikido.8.
  • Update urllib3 to version 2.8.0.
  • Update bellsoft py3-urllib3 to version 2.8.0-r0.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian python-urllib3 All versions
Debian:14 debian python-urllib3 < 2.8.0-1
Fix: upgrade to 2.8.0-1
pip andrey petrov urllib3 >= 1.26.0, < 2.8.0
Fix: upgrade to 2.8.0
– urllib3 urllib3 >= 1.26.0, < 2.8.0
Ubuntu:Pro:14.04:LTS canonical python-pip All versions
Ubuntu:Pro:14.04:LTS canonical python-urllib3 All versions
Root:PyPI – urllib3 < 1.26.18+aikido.5
< 2.7.0+aikido.1
< 1.26.12+aikido.6
< 2.6.3+aikido.3
< 2.6.2+aikido.4
< 1.26.14+aikido.10
< 1.26.7+aikido.7
< 1.26.13+aikido.8
Fix: upgrade to 1.26.18+aikido.5
pip – urllib3 >= 1.26.0, < 2.8.0
Fix: upgrade to 2.8.0
Alpaquita:stream bellsoft py3-urllib3 >= 1.26.12-r1, < 2.8.0-r0
Fix: upgrade to 2.8.0-r0
Original advisory text
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
CWE-440Expected Behavior Violation
Timeline
Published29 Sep 2026
Updated9 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-97687 · NVD
DEBIAN-CVE-2026-97687 · OSV
CVE-2026-97687 · OSV
GHSA-8988-9cw3-xx77 · GHSA
CVE-2026-97687 · MITRE
UBUNTU-CVE-2026-97687 · OSV
PYSEC-2026-4175 · OSV
ROOT-APP-PYPI-CVE-2026-97687 · OSV
BELL-CVE-2026-97687 · OSV
Track software like this
Free during beta