Log in Start free

Vulnerability · Published Sep 2, 2026 · Assigned by GitHub_M

CVE-2026-84381HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

High 8.1

In plain English

A high-severity security flaw in httpcore2 from pydantic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)<0.1%top 99.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes https. HTTPX2 exposes the flaw through Client.websocket() and AsyncClient.websocket() from 2.6.0 through 2.9.1, so the opening handshake, query parameters, Authorization headers, cookies, and subsequent frames can cross the proxy path in plaintext without certificate verification. An attacker controlling or observing that path can read or modify traffic and impersonate the WebSocket server. This issue is fixed in httpcore2 2.10.0 and HTTPX2 2.10.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIhttpcore22.10.0GHSA-7mj9-2mp8-4m2p
PyPIhttpcore22.10.0PYSEC-2026-3844
PyPIhttpx22.10.0GHSA-7mj9-2mp8-4m2p
PyPIhttpx22.10.0PYSEC-2026-3845
Ubuntu:26.10python-httpx2no fix listedUBUNTU-CVE-2026-84381

Affected products (as reported)

VendorProductVersions
pydantic httpx2 >= 2.6.0, < 2.10.0
pydantic httpcore2 < 2.10.0

Weakness: CWE-319 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References