CVE-2026-97687: urllib3 HTTPS Proxy TLS Configuration Vulnerability
Summary
CVE-2026-97687: urllib3: HTTPS proxy TLS configuration may be ignored or overridden. Affects urllib3 versions >= 1.26.0, < 2.8.0. Fixed in 2.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python that provides features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. It is widely used in various applications for making HTTP requests. However, versions 1.26.0 through 2.7.0 contain a vulnerability that affects the TLS configuration when connecting to HTTPS proxies, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from improper separation of TLS configurations for HTTPS proxies and target servers in urllib3 versions 1.26.0 to 2.7.0. This can lead to scenarios where the proxy's SSL context is ignored, and the target server's SSL context is used instead, compromising the integrity of the proxy connection. Attackers could exploit this to impersonate the proxy, intercepting sensitive data such as credentials and authentication tokens. Additionally, the misuse of certificate verification policies can disable proxy verification, allowing for further exploitation.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider avoiding the use of shared SSL contexts across multiple connections. Ensure that the proxy_ssl_context is explicitly defined for HTTPS proxies to maintain proper certificate verification.
Conclusion
In summary, the vulnerability CVE-2026-97687 in urllib3 poses significant risks related to TLS configuration when using HTTPS proxies. It is crucial to upgrade to version 2.8.0 or later to mitigate these risks and ensure secure connections. Regular monitoring and vulnerability checks using tools like Vulert can further enhance your application's security posture.
See every vulnerability recorded for urllib3 →
FAQ
The CVSS score for this vulnerability is 7.6, indicating a high severity level.
The affected versions are urllib3 versions 1.26.0 through 2.7.0.
Not addressing this vulnerability could allow attackers to impersonate the HTTPS proxy, intercept sensitive data, and potentially compromise user credentials.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a monitoring tool that uses Pipfile.lock to track and alert in real-time for open-source vulnerabilities in your software, ensuring you stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
