AIKIDO-2026-499214
urllib3 is vulnerable to Improper Certificate Validation
76
High Risk
This Affects:
urllib3TL;DR
urllib3 establishes the TLS handshake to HTTPS forwarding proxies using the destination host's certificate policy instead of the separate settings configured in proxy_ssl_context, proxy_assert_hostname, and proxy_assert_fingerprint. When an application configures distinct verification for the proxy versus the destination, the destination's settings silently take over the proxy handshake. This lets a party positioned between the client and the configured HTTPS proxy present a certificate that only needs to satisfy checks meant for the destination server, not the proxy. The fix separates the proxy TLS handshake from the destination TLS handshake so proxy-specific policy always applies to the proxy connection.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you connect through an HTTPS forwarding proxy with proxy_ssl_context, proxy_assert_hostname, or proxy_assert_fingerprint configured separately from the destination's TLS settings.
Background info
urllib3 is vulnerable to Improper Certificate Validation in versions 1.26.0 - 2.7.0.
How to fix this
Upgrade the urllib3 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.