---
schema_version: '1.0'
id: security-20260711-abfd3a
url: https://osv.dev/vulnerability/PYSEC-2026-1873
url_hash: abfd3a2979011c03fcbe1ed63469f7f82da874fc948be0d8e46e2fd0eb2203d7
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-1873
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2024-35195
- PYSEC-2026-1873
- severity:CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
- requests
- PyPI
lang: en
published_at: '2026-07-07T11:45:42Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:39:54Z'
status: published
content_hash: f8210f4ca85dfca9c9b9d762ce9dc54ea7e8f1f296241d69e34b783dbf6b2c29
license_note: full
summary: Requests `Session` object does not verify requests after making first request
  with verify=False
summary_source: rss
summary_en: Requests `Session` object does not verify requests after making first
  request with verify=False
entities:
- name: session_histority
  type: event
key_facts: []
related: []
related_auto:
- name: discord
  type: organization
  weight: 1.0
title: 'CVE-2024-35195: Requests `Session` object does not verify requests after making
  first request with verify=False'
---

# CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False

## TL;DR
Requests `Session` object does not verify requests after making first request with verify=False

## Key Points
- cve / CVE-2024-35195 / PYSEC-2026-1873 / severity:CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N / requests / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
**Advisory:** PYSEC-2026-1873 (CVE-2024-35195)

**Affected (your watchlist):**
- `PyPI:requests` 2.31.0 → fixed in 2.32.0 [docker/docker-strands+docker/local+docker/mac]

**Details:**
When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.

This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.

This behavior affects versions of `requests` prior to 2.32.0.

**References:**
- https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56
- https://nvd.nist.gov/vuln/detail/CVE-2024-35195
- https://github.com/psf/requests/pull/6655
- https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
- https://github.com/psf/requests
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ
- https://pypi.org/project/requests
- https://github.com/advisories/GHSA-9wx4-h78v-vm56

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-1873_

## Source
元記事: [CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False](https://osv.dev/vulnerability/PYSEC-2026-1873) — published 2026-07-07T11:45:42Z