CVE-2026-84381

Name of the Vulnerable Software and Affected Versions httpcore2 versions prior to 2.10.0 HTTPX2 versions 2.6.0 through 2.9.1

Description An issue exists where TLS fails to start when a remote origin uses wss (WebSocket Secure) through a SOCKS5 proxy because the TLS upgrade condition only recognizes https. This is exposed through the Client.websocket() and AsyncClient.websocket() functions. Consequently, the opening handshake, query parameters, Authorization headers, cookies, and subsequent frames may be transmitted across the proxy path in plaintext without certificate verification. An attacker observing or controlling this path could read or modify traffic and impersonate the WebSocket server.

Recommendations Update httpcore2 to version 2.10.0. Update HTTPX2 to version 2.10.0.