CVE-2026-97687

A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy's TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.

Last checked: 2026-10-13 22:09 UTC

• No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 19:48 UTC)

References

• NVD: CVE-2026-97687
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-10-24 20:47 UTC