---
schema_version: '1.0'
id: security-20260711-554627
url: https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56
url_hash: 554627f1fdd15821f0a50fae39759a0bf67ab1157be65bf1e0a9ace3c0686aa3
canonical_url: https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2024-35195
- GHSA-9wx4-h78v-vm56
- severity:CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
- requests
- PyPI
lang: en
published_at: '2024-05-20T20:15:00Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:39:54Z'
status: published
content_hash: 592a950bf8fb726631adcb7e349b9795d96e15235d364fd1805c47776ff8a2eb
license_note: full
summary: Requests `Session` object does not verify requests after making first request
  with verify=False
summary_source: rss
summary_en: Requests `Session` object does not verify requests after making first
  request with verify=False
entities:
- name: session_histority
  type: event
key_facts: []
related: []
related_auto:
- name: discord
  type: organization
  weight: 1.0
title: 'CVE-2024-35195: Requests `Session` object does not verify requests after making
  first request with verify=False'
---

# CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False

## TL;DR
Requests `Session` object does not verify requests after making first request with verify=False

## Key Points
- cve / CVE-2024-35195 / GHSA-9wx4-h78v-vm56 / severity:CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N / requests / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
**Advisory:** GHSA-9wx4-h78v-vm56 (CVE-2024-35195)

**Affected (your watchlist):**
- `PyPI:requests` 2.31.0 → fixed in 2.32.0 [docker/docker-strands+docker/local+docker/mac]

**Details:**
When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.

This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.

This behavior affects versions of `requests` prior to 2.32.0.

**References:**
- https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56
- https://nvd.nist.gov/vuln/detail/CVE-2024-35195
- https://github.com/psf/requests/pull/6655
- https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
- https://github.com/psf/requests
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56_

## Source
元記事: [CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False](https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56) — published 2024-05-20T20:15:00Z