← Vulnerability feed

Vulnerability record · CVE-2026-84381 · published 2 September 2026

CVE-2026-84381: Cleartext transmission vulnerability

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes https. HTTPX2 exposes the flaw through Client.websocket() and AsyncClient.websocket() from 2.6.0 through 2.9.1, so the opening handshake, query parameters, Authorization headers, cookies, and subsequent frames can cross the proxy path in plaintext without certificate verification. An attacker controlling or observing that path can read or modify traffic and impersonate the WebSocket server. This issue is fixed in httpcore2 2.10.0 and HTTPX2 2.10.0.

8.1 CVSS 3.1 High EPSS 0.11% · top 98.6% CWE-319 · Cleartext transmission Awaiting Analysis
8.1CVSS 3.1 base score
0.11%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
4References
9 Sep 2026Last modified by NVD

Description

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes https. HTTPX2 exposes the flaw through Client.websocket() and AsyncClient.websocket() from 2.6.0 through 2.9.1, so the opening handshake, query parameters, Authorization headers, cookies, and subsequent frames can cross the proxy path in plaintext without certificate verification. An attacker controlling or observing that path can read or modify traffic and impersonate the WebSocket server. This issue is fixed in httpcore2 2.10.0 and HTTPX2 2.10.0.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

LinkTags
https://github.com/pydantic/httpx2/commit/fb008dd700b761d955210d9692475c3e2f379453
https://github.com/pydantic/httpx2/pull/1104
https://github.com/pydantic/httpx2/releases/tag/v2.10.0
https://github.com/pydantic/httpx2/security/advisories/GHSA-7mj9-2mp8-4m2p

Track CVE-2026-84381 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2026-84381), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.