HTTPX2 uses httpcore2 to establish secure WebSocket connections via SOCKS proxies. The TLS upgrade logic in httpcore2 only recognizes URLs that start with https; connections using the wss scheme are therefore not upgraded. Consequently, the client creates a clear‑text WebSocket session through the proxy, sending the opening handshake, query parameters, Authorization headers, cookies, and all subsequent frames without encryption or server certificate verification. An attacker that can control or observe the proxy path can read, modify, or inject traffic, effectively impersonating the intended WebSocket server. This flaw aligns with CWE‑319, exposing a confidentiality and integrity risk.

The affected libraries are pydantic:httpcore2 and pydantic:httpx2. Vulnerable versions include all releases of httpcore2 prior to 2.10.0 and HTTPX2 from 2.6.0 through 2.9.1. The issue was addressed in httpcore2 2.10.0 and HTTPX2 2.10.0, so any installation of these older releases is at risk.

The CVSS score of 8.1 labels this problem as high severity, yet no EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have influence over or visibility into a SOCKS5 proxy used by the application, a condition common in many corporate or cloud environments. If such control is achieved, the attacker can intercept or alter WebSocket traffic and easily impersonate the server because no TLS handshake or certificate validation occurs. While the exploitation path is straightforward for users of the vulnerable library, the attack surface is limited to organizations that deploy unencrypted WebSocket traffic through third‑party proxies.