CVE-2026-84381: HTTPX2 secure WebSocket plaintext transmission via SOCKS proxy

CVE-2026-84381 · Severity: high · CVSS 8.1 · Published 2026-09-02

HTTPX2 is a popular Python HTTP client library used to make secure web requests and WebSocket connections. When routing secure WebSocket connections through a SOCKS proxy, the library fails to encrypt traffic as expected, instead sending authentication headers, cookies, and message content in plaintext. An attacker controlling or monitoring the SOCKS proxy could intercept sensitive credentials, query parameters, and application messages, or impersonate the WebSocket server to modify communications.

Technologies: httpx2 (PyPI). Vendors: Pydantic, PyPI.

Quick answers

Is CVE-2026-84381 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84381 being exploited in the wild.
How severe is CVE-2026-84381?
High severity, with a CVSS score of 8.1, published 2 September 2026.
Which products and versions are affected?
Pydantic Httpcore < 2.10.0; httpcore2 (PyPI) < 2.10.0, ECOSYSTEM:introduced=0,fixed=2.10.0; httpx2 (PyPI) >= 2.6.0, < 2.10.0, ECOSYSTEM:introduced=2.6.0,fixed=2.10.0.
Is there a fix for CVE-2026-84381?
Yes. httpcore2 (PyPI): upgrade to 2.10.0 or later; httpx2 (PyPI): upgrade to 2.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84381 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-84381?
Check whether you run Pydantic Httpcore, httpcore2 (PyPI) or httpx2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • httpcore2 (PyPI): upgrade to 2.10.0 or later
    pip install "httpcore2>=2.10.0"
  • httpx2 (PyPI): upgrade to 2.10.0 or later
    pip install "httpx2>=2.10.0"

Technical details

The vulnerability stems from incomplete scheme validation in the SOCKS5 proxy connection upgrade logic. The code checks only for the "https" scheme when deciding whether to initiate TLS after the SOCKS handshake, omitting the "wss" (secure WebSocket) scheme. Consequently, after a successful SOCKS5 tunnel establishment, the raw unencrypted stream is passed directly to the HTTP/1.1 layer, which sends the WebSocket upgrade request without performing a TLS handshake or certificate verification. An attacker with control over the SOCKS proxy or network visibility can observe plaintext authentication headers, cookies, URL query parameters, and all WebSocket frames. The attacker may also forge a 101 Switching Protocols response to hijack the connection. Patched versions in 2.10.0 and later correctly include "wss" in the scheme check to enforce TLS upgrade for both https and wss origins.

Affected products

  • Pydantic httpcore2 < 2.10.0
  • Pydantic httpx2 2.6.0 to 2.9.1

Identifiers

  • CVE-2026-84381
  • GHSA-7mj9-2mp8-4m2p
  • PYSEC-2026-3844
  • PYSEC-2026-3845

Timeline

  • 2026-08-18: disclosed
  • 2026-09-08: advisory
  • 2026-09-08: patched: Version 2.10.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.