Executive brief
HTTPX2 is a popular Python HTTP client library used to make secure web requests and WebSocket connections. When routing secure WebSocket connections through a SOCKS proxy, the library fails to encrypt traffic as expected, instead sending authentication headers, cookies, and message content in plaintext. An attacker controlling or monitoring the SOCKS proxy could intercept sensitive credentials, query parameters, and application messages, or impersonate the WebSocket server to modify communications.
Technical details
The vulnerability stems from incomplete scheme validation in the SOCKS5 proxy connection upgrade logic. The code checks only for the "https" scheme when deciding whether to initiate TLS after the SOCKS handshake, omitting the "wss" (secure WebSocket) scheme. Consequently, after a successful SOCKS5 tunnel establishment, the raw unencrypted stream is passed directly to the HTTP/1.1 layer, which sends the WebSocket upgrade request without performing a TLS handshake or certificate verification. An attacker with control over the SOCKS proxy or network visibility can observe plaintext authentication headers, cookies, URL query parameters, and all WebSocket frames. The attacker may also forge a 101 Switching Protocols response to hijack the connection. Patched versions in 2.10.0 and later correctly include "wss" in the scheme check to enforce TLS upgrade for both https and wss origins.
Affected products
- Pydantic httpcore2 < 2.10.0
- Pydantic httpx2 2.6.0 to 2.9.1
Timeline
- 2026-08-18: disclosed
- 2026-09-08: advisory
- 2026-09-08: patched: Version 2.10.0 released with fix