HTTP Client Vulnerability in HTTPX2 Affects Python Applications
CVE-2026-84381

8.1HIGH

Key Information:

Vendor

Pydantic

Status
Httpx2
Httpcore2
Vendor
CVE Published:
2 September 2026

What is CVE-2026-84381?

The HTTPX2 library has a vulnerability due to improper TLS negotiation when using WebSocket connections through a SOCKS5 proxy. This issue arises from the library's failure to properly recognize the wss protocol, resulting in the potential exposure of sensitive data in plaintext. With no certificate verification, attackers can intercept, read, or modify the traffic between the client and the server. This could lead to severe security risks, including unauthorized access and data manipulation. The flaw affects versions 2.6.0 to 2.9.1 of HTTPX2 and has been addressed in version 2.10.0.

Affected Version(s)

httpcore2 < 2.10.0

httpx2 >= 2.6.0, < 2.10.0

References

https://github.com/pydantic/httpx2/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/pydantic/httpx2/pull/1104
x_refsource_MISC
https://github.com/pydantic/httpx2/commit/fb008dd700b761d...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.