CVE-2026-84381
Received Received - Intake

WebSocket TLS Bypass in HTTPX2 via SOCKS5 Proxy

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes https. HTTPX2 exposes the flaw through Client.websocket() and AsyncClient.websocket() from 2.6.0 through 2.9.1, so the opening handshake, query parameters, Authorization headers, cookies, and subsequent frames can cross the proxy path in plaintext without certificate verification. An attacker controlling or observing that path can read or modify traffic and impersonate the WebSocket server. This issue is fixed in httpcore2 2.10.0 and HTTPX2 2.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84381
EUVD
EUVD-2026-70250

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pydantic httpx2 From 2.6.0 (inc) to 2.9.1 (inc)
pydantic httpcore2 to 2.10.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects HTTPX2 and httpcore2 libraries. When using a SOCKS5 proxy, WebSocket Secure (wss://) connections fail to initiate TLS encryption. This means sensitive data like headers, cookies, and WebSocket frames are sent in plaintext through the proxy without certificate verification. The flaw exists because the code only recognized HTTPS for TLS upgrades but not WSS when routed through SOCKS5 proxies.

Detection Guidance

Check if your HTTPX2 or httpcore2 versions are below 2.10.0 by running: pip show httpx2 or pip show httpcore2. If using SOCKS5 proxies with WebSocket Secure (wss://) connections, inspect network traffic for unencrypted WebSocket frames.

Impact Analysis

An attacker monitoring or controlling the proxy path can read, modify, or forge WebSocket traffic. This includes intercepting sensitive information like authorization headers, cookies, query parameters, and WebSocket messages. The lack of TLS means no certificate verification occurs, allowing impersonation of the WebSocket server.

Compliance Impact

This vulnerability violates data protection requirements under GDPR and HIPAA by exposing sensitive data in transit without encryption. GDPR mandates strong encryption for personal data, while HIPAA requires secure transmission of protected health information. Failure to encrypt WebSocket traffic through proxies risks non-compliance and potential data breaches.

Mitigation Strategies

Upgrade HTTPX2 and httpcore2 to version 2.10.0 or later. Avoid using SOCKS5 proxies for wss:// connections until patched. Monitor network traffic for plaintext WebSocket frames if using vulnerable versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84381. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart