Description

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes https. HTTPX2 exposes the flaw through Client.websocket() and AsyncClient.websocket() from 2.6.0 through 2.9.1, so the opening handshake, query parameters, Authorization headers, cookies, and subsequent frames can cross the proxy path in plaintext without certificate verification. An attacker controlling or observing that path can read or modify traffic and impersonate the WebSocket server. This issue is fixed in httpcore2 2.10.0 and HTTPX2 2.10.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-02T19:18:08.217Z",
  "pubdate": "2026-09-02T19:18:08.217Z",
  "executiveSummary": "A critical security flaw exists in HTTPX2 and httpcore2 versions prior to 2.10.0, involving improper TLS handling when establishing WebSocket connections (wss) over a SOCKS5 proxy.\nThe vulnerability stems from a restrictive TLS upgrade condition in the proxy handling logic that fails to initiate secure transport for WebSocket traffic, defaulting to plaintext communication.\nThis exposure allows an attacker positioned on the network path to intercept, read, and manipulate sensitive data, including authentication headers, cookies, and WebSocket frames.\nThe flaw affects both synchronous and asynchronous WebSocket implementations in HTTPX2 (versions 2.6.0 through 2.9.1) and the underlying httpcore2 library.\nRisk implications include full credential compromise and man-in-the-middle (MitM) attacks, effectively bypassing end-to-end encryption requirements. Exploitation requires the attacker to be in a position to observe or control traffic routing between the client and the SOCKS5 proxy.",
  "technicalDetails": "The vulnerability is located within the SOCKS5 proxy implementation in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py. The root cause is a flawed conditional check that governs the initiation of the TLS handshake during the proxy connection process. Specifically, the library logic evaluates the protocol scheme but restricts the TLS upgrade trigger exclusively to 'https' requests. Consequently, when a user initiates a WebSocket connection using the 'wss' scheme through a SOCKS5 proxy, the library fails to recognize the requirement for a TLS wrapper, resulting in the connection proceeding in plaintext.\nHTTPX2 exposes this vulnerability via the Client.websocket() and AsyncClient.websocket() methods. When these methods are invoked while configured to use a SOCKS5 proxy, the handshake process fails to wrap the socket in a TLS layer. This results in the entire initial WebSocket handshake—which frequently contains sensitive information such as Authorization headers, session cookies, and query parameters—being transmitted in cleartext through the proxy server.\nThe attack flow proceeds as follows: 1) The client initiates a wss connection request directed at a proxy. 2) The vulnerable code path in httpcore2 identifies the request protocol, fails to match 'https', and skips the TLS initialization logic. 3) The client establishes a TCP connection to the proxy and communicates in plaintext. 4) An attacker observing the network path between the client and the SOCKS5 proxy intercepts the unencrypted traffic. 5) The attacker reads the sensitive headers and cookies contained within the handshake. 6) The attacker proceeds to intercept or inject subsequent WebSocket frames, effectively impersonating the server or hijacking the client session.\nBecause the client is unaware that the transport is insecure, it does not perform any certificate verification, as no TLS negotiation ever occurs. This eliminates the possibility of the client detecting an MitM interception. The flaw impacts any application utilizing HTTPX2 versions 2.6.0 through 2.9.1 that utilizes a SOCKS5 proxy for WebSocket traffic, creating a significant security regression for any environment relying on proxy-based routing for secure communications."
}