CVE-2026-97687

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Published Sep 29, 2026 CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Description

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.

Analysis

Technical impact

This bug causes HTTPS proxy TLS parameters to be merged with target‑server TLS settings, enabling an attacker to impersonate the proxy. By injecting a forged certificate the attacker can observe, modify, or inject traffic to the intended server while an end‑to‑end TLS connection to the final target remains intact. The flaw is a moderate‑to‑high severity issue (CVSS 7.6) that can lead to confidentiality and integrity violations for applications relying on urllib3 to mediate HTTPS traffic.

Affected Systems

All Python applications that use urllib3 versions from 1.26.0 up to but not including 2.8.0, and that configure a HTTPS proxy along with target‑server TLS options such as proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, or use_forwarding_for_https, are affected.

Risk and Exploitability

The vulnerability is rated 7.6 on CVSS and is not currently listed in the CISA KEV catalog. EPSS is unavailable, suggesting limited publicly known exploits. An attacker who can control or intercept the HTTPS proxy can exploit the merged TLS context to perform a man‑in‑the‑middle attack. Because many web‑client applications depend on urllib3 without careful TLS configuration, the risk is significant for systems that rely on proxy settings.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

urllib3

affected

Version	Status	Constraints
`>= 1.26.0, < 2.8.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Urllib3

Version	Status	Scheme	Platform
`[1.26.0,2.8.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade urllib3 to version 2.8.0 or later to apply the fix that separates proxy and target TLS contexts.
Reconfigure the proxy settings to avoid reusing the same TLS context for both proxy and target connections; ensure CERT_NONE is not applied globally.
Verify that proxy_ssl_context and target server TLS parameters remain distinct and enforce strict certificate verification wherever possible.

Generated by OpenCVE AI on September 30, 2026 at 01:19 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-8988-9cw3-xx77	urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465
https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3
https://github.com/urllib3/urllib3/pull/5093
https://github.com/urllib3/urllib3/releases/tag/2.8.0
https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77
https://nvd.nist.gov/vuln/detail/CVE-2026-97687
https://www.cve.org/CVERecord?id=CVE-2026-97687

History

Oct 13, 2026 8:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Python Python urllib3
CPEs		cpe:2.3:a:python:urllib3::::::::
Vendors & Products		Python Python urllib3
Metrics	cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}`

Sep 30, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 30, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-97687 https://www.cve.org/CVERecord?id=CVE-2026-97687
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}` threat_severity `Important`

Sep 29, 2026 6:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Urllib3 Urllib3 urllib3
Vendors & Products		Urllib3 Urllib3 urllib3

Sep 29, 2026 3:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.
Title		urllib3: HTTPS proxy TLS configuration may be ignored or overridden
Weaknesses		CWE-295 CWE-440
References		https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465 https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3 https://github.com/urllib3/urllib3/pull/5093 https://github.com/urllib3/urllib3/releases/tag/2.8.0 https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77
Metrics		cvssV4_0 `{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`