Skip to content
CVE IDCVE-2024-35195GitHub advisory IDGHSA-9wx4-h78v-vm56

Requests `Session` object does not verify requests after making first request with verify=False

CVE-2024-35195 (GitHub advisory GHSA-9wx4-h78v-vm56) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.6, classed as Always-Incorrect Control Flow Implementation (CWE-670), in requests (PyPI). Affected versions: < 2.32.0. It is fixed in 2.32.0.

Medium5.6Fix availableGitHub reviewed

Published 20 May 2024Updated 16 Jan 2026

5.6MediumCVSS 3.1
CVE ID
CVE-2024-35195
GHSA ID
GHSA-9wx4-h78v-vm56
EPSS
0.34%higher than 27% of CVEs
Weakness (CWE)
  • CWE-670Always-Incorrect Control Flow Implementation
KEV status
Not in KEV
Published
20 May 2024
Updated
16 Jan 2026
Ecosystem
  • PyPI
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

When using a requests.Session, if the first request to a given origin is made with verify=False, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if verify=True is explicitly specified later.

This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.

This behavior affects versions of requests prior to 2.32.0.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Medium5.6Base score from GitHub Advisory Database

Attack Vector AV
Local
Attack Complexity AC
High
Privileges Required PR
High
User Interaction UI
Required
Scope S
Unchanged
Confidentiality C
High
Integrity I
High
Availability A
None

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
no
Needs manual steps per target
Technical impact
total
Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • requests
    PyPI
    pkg:pypi/requests
    Affected versions
    < 2.32.0
    Fixed in
    2.32.0
    Show 151 listed versions
    • 0.0.1
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.10.3
    • 0.10.4
    • 0.10.6
    • 0.10.7
    • 0.10.8
    • 0.11.1
    • 0.11.2
    • 0.12.0

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 2.32.0 or later.

Patch commits

  • a58d7f2Patch commitgithub.com/psf/requests

    Merge pull request #6655 from sigmavirus24/fix-tls-floppy

    +65 −2 across 3 files

    • src/requests/adapters.py+57 −1
    • tests/test_requests.py+7 −0
    • tox.ini+1 −1
  • #6655Pull requestgithub.com/psf/requests

Vulnerability intelligence

References

Credits

Questions about CVE-2024-35195

What is the GHSA ID for CVE-2024-35195?
GitHub tracks CVE-2024-35195 as GHSA-9wx4-h78v-vm56.
What is the CVSS score of CVE-2024-35195?
CVE-2024-35195 has a CVSS 3.1 base score of 5.6 (Medium), vector CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N.
Which versions are affected by CVE-2024-35195?
requests (PyPI): < 2.32.0.
How do I fix CVE-2024-35195?
Upgrade to 2.32.0 or later. The fix is in commit a58d7f2 and pull request #6655.
What is the Package URL (PURL) for CVE-2024-35195?
The affected package's PURL is pkg:pypi/requests.
Is CVE-2024-35195 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2024-35195. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 27% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 6 days ago (8 Oct 2026, 08:02 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.