Httpcore2
Monthly
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebSocket session - opening handshake, query parameters, Authorization headers, cookies, and message frames - in plaintext to anyone who can observe or control the proxy path. Affected are applications using Client.websocket() or AsyncClient.websocket() in HTTPX2 versions 2.6.0 through 2.9.1 when routing through a SOCKS5 proxy. An adjacent-network attacker can passively eavesdrop on or actively modify traffic, and can impersonate the WebSocket server due to the missing certificate verification step. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebSocket session - opening handshake, query parameters, Authorization headers, cookies, and message frames - in plaintext to anyone who can observe or control the proxy path. Affected are applications using Client.websocket() or AsyncClient.websocket() in HTTPX2 versions 2.6.0 through 2.9.1 when routing through a SOCKS5 proxy. An adjacent-network attacker can passively eavesdrop on or actively modify traffic, and can impersonate the WebSocket server due to the missing certificate verification step. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.