Log in Start free

Vulnerability · Published Sep 29, 2026 · Assigned by GitHub_M

CVE-2026-97687urllib3: HTTPS proxy TLS configuration may be ignored or overridden

High 7.6

In plain English

A high-severity improper certificate validation in urllib3 from urllib3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.6High
Exploit odds (30 days)0.2%top 89.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10python3-urllib31.26.19-4.el10_2.2ALSA-2026:85930
AlmaLinux:9python3-urllib31.26.5-8.el9_8.2ALSA-2026:90494
AlmaLinux:8python3.12-urllib31.26.19-5.el8_10ALSA-2026:92474
AlmaLinux:9python3.12-urllib31.26.19-3.el9_8.2ALSA-2026:85929
AlmaLinux:10python3.14-urllib32.6.3-2.el10_2.6ALSA-2026:84578
AlmaLinux:9python3.14-urllib32.6.3-2.el9_8.6ALSA-2026:84577
Debian:12python-urllib3no fix listedDEBIAN-CVE-2026-97687
Debian:13python-urllib3no fix listedDEBIAN-CVE-2026-97687
Debian:14python-urllib32.8.0-1DEBIAN-CVE-2026-97687
PyPIurllib32.8.0GHSA-8988-9cw3-xx77
PyPIurllib32.8.0PYSEC-2026-4175
Rocky Linux:10python-urllib30:1.26.19-4.el10_2.2RLSA-2026:85930
Rocky Linux:9python-urllib30:1.26.5-8.el9_8.2RLSA-2026:90494
Rocky Linux:8python3.12-urllib30:1.26.19-5.el8_10RLSA-2026:92474
Rocky Linux:9python3.12-urllib30:1.26.19-3.el9_8.2RLSA-2026:85929
Rocky Linux:10python3.14-urllib30:2.6.3-2.el10_2.6RLSA-2026:84578
Rocky Linux:9python3.14-urllib30:2.6.3-2.el9_8.6RLSA-2026:84577
Ubuntu:26.10python-pipno fix listedUBUNTU-CVE-2026-97687
Ubuntu:22.04:LTSpython-urllib3no fix listedUBUNTU-CVE-2026-97687
Ubuntu:22.04:LTSpython-urllib31.26.5-1~exp1ubuntu0.8USN-8926-1
Ubuntu:24.04:LTSpython-urllib3no fix listedUBUNTU-CVE-2026-97687
Ubuntu:24.04:LTSpython-urllib32.0.7-1ubuntu0.8USN-8926-1
Ubuntu:26.04:LTSpython-urllib32.6.3-1ubuntu1.2UBUNTU-CVE-2026-97687
Ubuntu:26.04:LTSpython-urllib32.6.3-1ubuntu1.2USN-8926-1

Affected products (as reported)

VendorProductVersions
urllib3 urllib3 >= 1.26.0, < 2.8.0

Weakness: CWE-295, CWE-440 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References