# CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False

> CVE-2024-35195 (GitHub advisory GHSA-9wx4-h78v-vm56) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.6, classed as Always-Incorrect Control Flow Implementation (CWE-670), in requests (PyPI). Affected versions: < 2.32.0. It is fixed in 2.32.0.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2024-35195

| Field | Value |
| --- | --- |
| CVE | CVE-2024-35195 |
| GHSA | GHSA-9wx4-h78v-vm56 |
| Severity | Medium |
| CVSS 3.1 | 5.6 `CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N` (GitHub Advisory Database) |
| CWE | CWE-670 Always-Incorrect Control Flow Implementation |
| EPSS | 0.34% (higher than 27% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact total |
| Published | 20 May 2024 |
| Modified | 16 Jan 2026 |

## Description

When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.

This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.

This behavior affects versions of `requests` prior to 2.32.0.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| requests | PyPI | `pkg:pypi/requests` | < 2.32.0 | 2.32.0 |

## Fix commits

- Patch: https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
- Pull request: https://github.com/psf/requests/pull/6655

## Questions

**What is the GHSA ID for CVE-2024-35195?**

GitHub tracks CVE-2024-35195 as GHSA-9wx4-h78v-vm56.

**What is the CVSS score of CVE-2024-35195?**

CVE-2024-35195 has a CVSS 3.1 base score of 5.6 (Medium), vector CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N.

**Which versions are affected by CVE-2024-35195?**

requests (PyPI): < 2.32.0.

**How do I fix CVE-2024-35195?**

Upgrade to 2.32.0 or later. The fix is in commit a58d7f2 and pull request #6655.

**What is the Package URL (PURL) for CVE-2024-35195?**

The affected package's PURL is pkg:pypi/requests.

**Is CVE-2024-35195 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2024-35195. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 27% of CVEs.

## References

- https://github.com/psf/requests/pull/6655 (fix)
- https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac (fix)
- https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56 (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2024-35195 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35195.json (advisory)
- https://github.com/advisories/GHSA-9wx4-h78v-vm56 (advisory)
- https://github.com/psf/requests (package)
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2024-35195), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.