CVE-2026-97687

Name of the Vulnerable Software and Affected Versions urllib3 versions 1.26.0 through 2.7.x

Description Target-server TLS settings are incorrectly applied to the HTTPS proxy connection, causing configuration paths to fail to remain separated. This occurs when an application uses an HTTPS proxy and configures target-server TLS settings that must be distinct from the proxy TLS handshake, such as HTTPS forwarding with target-specific identity or credentials. Specifically, applying cert reqs=CERT NONE can mutate the proxy ssl context.verify mode in place. This mutation persists, potentially allowing subsequent connections reusing the same context to connect to the HTTPS proxy without certificate verification. An attacker capable of intercepting traffic can impersonate the HTTPS proxy to observe or modify forwarded traffic or capture a target TLS client certificate. Direct HTTPS connections without a proxy are not impacted.

Recommendations Update to version 2.8.0.