Plaintext WebSocket Exposure in HTTPX2 and httpcore2 via SOCKS5 Proxy

The Python libraries httpcore2 (releases prior to 2.10.0) and httpx2 (releases 2.6.0 through 2.9.1) contain a security vulnerability where TLS is not correctly initialized for secure WebSocket (wss://) connections routed through SOCKS5 proxies. The SOCKS5 connection implementation includes a check to upgrade to TLS only for https origins, failing to include wss in the logic. Consequently, the client transmits the WebSocket opening handshake and all subsequent frames in plaintext through the proxy. This vulnerability, tracked as CVE-2026-84381, violates RFC 6455 requirements for secure WebSocket communication, rendering the transport susceptible to interception, modification, and server impersonation by any actor controlling or observing the SOCKS proxy path.

Impact

Successful exploitation allows a malicious or compromised SOCKS proxy to intercept sensitive information, including URL query parameters, authentication tokens in Authorization headers, and session cookies. Furthermore, because the TLS handshake is bypassed, the client fails to verify the server's certificate, enabling an attacker to perform man-in-the-middle attacks by impersonating the target server and injecting or altering application-level WebSocket messages.

Recommendation

• Upgrade all instances of httpx2 and httpcore2 to version 2.10.0 or later.
• If upgrading is not immediately possible, modify application configuration to bypass SOCKS proxies for all wss:// connections.
• Review application logs for WebSocket traffic originating from servers configured to use SOCKS5 proxies to identify potential exposure.
• Patch CVE-2026-84381 across all environments utilizing affected versions of the HTTPX2 library.