CVE-2026-97687
published 2026-09-29CVE-2026-97687: urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context…
PriorityP344high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
0.21%
10.5th percentile
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-urllib3 | — | — |
| python | urllib3 | >= 1.26.0 < 2.8.0 | 2.8.0 |
| ubuntu | python-urllib3 | — | — |
| urllib3 | urllib3 | — | — |
| urllib3 | urllib3 | >= 1.26.0 < 2.8.0 | 2.8.0 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
nvdv4.07.6HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu8.1HIGH
vendor_redhat7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
urllib3 vulnerabilities
vendor_ubuntu·2026-10-14·CVSS 8.1
CVE-2026-97688 [HIGH] urllib3 vulnerabilities
Title: urllib3 vulnerabilities
Summary: Several security issues were fixed in urllib3.
Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not
correctly handle certain certificate validations. An attacker could
possibly use this issue to observe or modify forwarded traffic. This
issue only affected Ubuntu 26.04 LTS. (CVE-2026-97687)
Martin Desrumaux discovered that urllib3 did not correctly handle
decoding certain deflate responses. An attacker could possibly use this
issue to cause a denial of service. This issue only affected
Ubuntu 26.04 LTS. (CVE-2026-97688)
It was discovered that urllib3 did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial
of service. (CVE-2026-97689)
Instructions: In general, a standard
Red Hat
urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override
vendor_redhat·2026-09-29·CVSS 7.6
CVE-2026-97687 [HIGH] CWE-295 urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override
urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override
A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy's TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.
Package: grafana12.4 (Red Hat Hardened Images) - Not affected
Package: grafana13.1 (Red Hat Hardened Images) - Not affected
Package: grafana13.2 (Red Hat Hardened Images) - Not affected
Package: jaeger (Red Hat Hardened Images) - Not
GHSA
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
ghsa·2026-09-30
CVE-2026-97687 [HIGH] CWE-295 urllib3: HTTPS proxy TLS configuration may be ignored or overridden
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
## Impact
urllib3 supports configuring TLS independently for an HTTPS proxy and the target server.
`proxy_ssl_context`, `proxy_assert_hostname`, and `proxy_assert_fingerprint` configure the TLS connection to the proxy. `ssl_context` and the other target-specific TLS parameters configure the connection to the target server.
In urllib3 versions 1.26.0 through 2.7.0, these configurations were not consistently separated. Depending on the proxy mode, urllib3 could:
1. Ignore `proxy_ssl_context` and use the target server's SSL context for the TLS connection to an HTTPS forwarding proxy.
2. Override the HTTPS proxy's certificate-verification policy with the target server's certificate-verification policy.
3. Apply target-spe
No detection rules found.
No public exploits indexed.
https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3https://github.com/urllib3/urllib3/pull/5093https://github.com/urllib3/urllib3/releases/tag/2.8.0https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77
2026-09-29
Published