Description
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.
Published: 2026-09-29
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: TLS Interception
Action: Immediate Patch
AI Analysis

Impact

This bug causes HTTPS proxy TLS parameters to be merged with target‑server TLS settings, enabling an attacker to impersonate the proxy. By injecting a forged certificate the attacker can observe, modify, or inject traffic to the intended server while an end‑to‑end TLS connection to the final target remains intact. The flaw is a moderate‑to‑high severity issue (CVSS 7.6) that can lead to confidentiality and integrity violations for applications relying on urllib3 to mediate HTTPS traffic.

Affected Systems

All Python applications that use urllib3 versions from 1.26.0 up to but not including 2.8.0, and that configure a HTTPS proxy along with target‑server TLS options such as proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, or use_forwarding_for_https, are affected.

Risk and Exploitability

The vulnerability is rated 7.6 on CVSS and is not currently listed in the CISA KEV catalog. EPSS is unavailable, suggesting limited publicly known exploits. An attacker who can control or intercept the HTTPS proxy can exploit the merged TLS context to perform a man‑in‑the‑middle attack. Because many web‑client applications depend on urllib3 without careful TLS configuration, the risk is significant for systems that rely on proxy settings.

Generated by OpenCVE AI on September 30, 2026 at 01:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade urllib3 to version 2.8.0 or later to apply the fix that separates proxy and target TLS contexts.
  • Reconfigure the proxy settings to avoid reusing the same TLS context for both proxy and target connections; ensure CERT_NONE is not applied globally.
  • Verify that proxy_ssl_context and target server TLS parameters remain distinct and enforce strict certificate verification wherever possible.

Generated by OpenCVE AI on September 30, 2026 at 01:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden
History

Tue, 13 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Python
Python urllib3
CPEs cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*
Vendors & Products Python
Python urllib3
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

Wed, 30 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

threat_severity

Important

Tue, 29 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Urllib3
Urllib3 urllib3
Vendors & Products Urllib3
Urllib3 urllib3

Tue, 29 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
Description urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.
Title urllib3: HTTPS proxy TLS configuration may be ignored or overridden
Weaknesses CWE-295
CWE-440
References
Metrics cvssV4_0

{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Python Urllib3
Urllib3 Urllib3
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-30T20:11:09.721Z

Reserved: 2026-09-24T21:43:37.208Z

Link: CVE-2026-97687

cve-icon Vulnrichment

Updated: 2026-09-30T19:48:58.509Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T16:17:18.517

Modified: 2026-10-13T20:27:23.130

Link: CVE-2026-97687

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-29T15:30:27Z

Links: CVE-2026-97687 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T01:30:17Z

Weaknesses
  • CWE-295

    Improper Certificate Validation

  • CWE-440

    Expected Behavior Violation