CVE-2026-97687: urllib3 - HTTPS Proxy TLS Configuration Vulnerability
Summary
CVE-2026-97687: urllib3: HTTPS proxy TLS configuration may be ignored or overridden. Affects urllib3 versions >= 1.26.0, < 2.8.0. Fixed in 2.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python, widely used for making HTTP requests. It provides features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. However, certain versions of urllib3 (1.26.0 to 2.7.0) have a vulnerability that affects how TLS configurations are applied when connecting to HTTPS proxies, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from improper handling of TLS configurations for HTTPS proxies in urllib3 versions 1.26.0 through 2.7.0. Specifically, the library may ignore or override the TLS settings intended for the proxy connection, leading to scenarios where an attacker could impersonate the proxy. This can result in the exposure of sensitive data, such as credentials and authentication tokens, as well as the potential for man-in-the-middle attacks. The issue stems from the fact that the library does not consistently separate the TLS configurations for the proxy and the target server, allowing for dangerous misconfigurations.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to ensure that the proxy_ssl_context is explicitly defined and not reused across multiple connections. This can help maintain the intended certificate verification policies. Example code snippet for setting up a proxy SSL context:
import urllib3
from ssl import create_default_context
proxy_ssl_context = create_default_context()
proxy_ssl_context.verify_mode = CERT_REQUIRED # Ensure verification is required
http = urllib3.PoolManager(proxy_ssl_context=proxy_ssl_context)
response = http.request('GET', 'https://example.com', use_forwarding_for_https=True)
Conclusion
In summary, the vulnerability CVE-2026-97687 in urllib3 poses significant security risks due to improper handling of TLS configurations for HTTPS proxies. It is crucial to upgrade to version 2.8.0 or later to mitigate these risks effectively. Additionally, users can utilize Vulert to monitor and check for vulnerabilities in their applications.
See every vulnerability recorded for urllib3 →
FAQ
The CVSS score of this vulnerability is 7.6, indicating a high level of severity.
urllib3 versions 1.26.0 through 2.7.0 are affected by this vulnerability.
The risks include potential exposure of sensitive information, man-in-the-middle attacks, and the ability for attackers to impersonate the HTTPS proxy.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, ensure that the proxy_ssl_context is explicitly defined and not reused across connections to maintain proper certificate verification.
References
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
