Skip to content
Fencer Vulns
medium 5.6

CVE-2024-35195 json

Requests `Session` object does not verify requests after making first request with verify=False

published 2024-05-20 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1565 , GHSA-9wx4-h78v-vm56 , PYSEC-2026-1873

cvss
5.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

Patch / fix

  • pypi requests 2.32.0
  • request_project request 2.32.0
  • requests Debian 14, Debian 13 2.32.3+dfsg-1

debian advisories DEBIAN-CVE-2024-35195

  • python-pip Ubuntu Pro 22.04 LTS 22.0.2+dfsg-1ubuntu0.7+esm1
  • python-pip Ubuntu Pro 24.04 LTS 24.0+dfsg-1ubuntu1.3+esm1

ubuntu advisories UBUNTU-CVE-2024-35195

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-requests RHEL 9 2.25.1-9.el9
  • python3-requests RHEL 9 2.25.1-9.el9
  • python3-requests+socks RHEL 9 2.25.1-9.el9
  • python3-requests+security RHEL 9 2.25.1-9.el9
  • foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.6-1.el8sat
  • foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.6-1.el9sat
  • candlepin satellite 6.16 4.4.21-1.el8sat
  • candlepin satellite 6.16 4.4.21-1.el9sat

red hat advisories RHSA-2025:7049RHSA-2025:2399RHSA-2025:1335RHSA-2025:0012RHSA-2024:9988RHSA-2024:3781

  • python-requests Linux Micro 6.0 2.32.3-1.1
  • python-requests Linux Micro 6.0 2.32.2-1.1
  • python-requests SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Python 3 15 SP6 +6 more 2.31.0-150400.6.15.1
  • python-requests SLE Module for Advanced Systems Management 12, Manager Client Tools 12 2.11.1-6.40.1
  • python-requests SLES for SAP 12 SP5, SLES 12 SP5, SLE Module for Public Cloud 12 +1 more 2.24.0-8.20.1
  • python-requests SLE Module for Basesystem 15 SP6, SLE Module for Basesystem 15 SP5, SLE Micro 5.5 +17 more 2.25.1-150300.3.9.1
  • python-docker SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 +2 more 7.0.0-150400.8.7.1
  • python-docker Manager Client Tools 15 2.6.1-150000.4.3.1

suse advisories SUSE-SU-2025:20094-1SUSE-SU-2025:20034-1SUSE-RU-2024:3600-1SUSE-RU-2024:3599-1SUSE-RU-2024:3598-1SUSE-SU-2024:1880-2

  • python-requests openSUSE Tumbleweed 2.34.2-1.2

opensuse advisories openSUSE-SU-2026:12038-1

  • python3-requests AlmaLinux 9 2.25.1-9.el9
  • python3-requests+socks AlmaLinux 9 2.25.1-9.el9
  • python3-requests+security AlmaLinux 9 2.25.1-9.el9
  • python3-requests AlmaLinux 8 2.20.0-5.el8_10

almalinux advisories ALSA-2025:7049ALSA-2025:0012

  • python-requests Rocky Linux 9 2.25.1-9.el9
  • python-requests Rocky Linux 8 2.20.0-5.el8_10

rocky linux advisories RLSA-2025:7049RLSA-2025:0012

  • py3-requests Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 2.32.3-r0

alpine advisories ALPINE-CVE-2024-35195

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tensorflow Azure Linux 3.0 2.16.1-8
  • python-requests Azure Linux 3.0 2.31.0-2
  • python-requests CBL-Mariner 2.0 2.27.1-7

azure linux advisories AZL-42106AZL-42127AZL-42145

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-35195 updated cvss 5.6

requests: subsequent requests to the same host ignore cert verification

  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-baremetal-container Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 python-requests Red Hat Enterprise Linux 7 pykickstart, python-requests, resource-agents, resource-agents-gcp, resource-agents-sap, sap-cluster-connector, +3 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 python2-pip, python-requests, python3-requests, python2-pip-wheel
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 10 python-requests
    affected: no fix available
  • Red Hat OpenShift Container Platform 3.11 python-requests, python2-requests, openvswitch-ovn-kubernetes
    affected: no fix planned “Out of support scope”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: no fix available
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-requests 2.32.2-1.el8ap, python3x-requests 2.32.2-1.el8ap, automation-controller-venv-tower 4.5.8-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-requests 2.32.2-1.el9ap, python3-requests 2.32.2-1.el9ap, automation-controller-venv-tower 4.5.8-1.el9ap
    fixed: vendor fix RHSA-2024:3781
  • Red Hat Developer Hub 1.2 for RHEL 9 rhdh/rhdh-hub-rhel9 1.2-105
    fixed: vendor fix RHEA-2024:4071
show 8 more
  • Red Hat Discovery 1.14 discovery 1.14.2-1748467619
    fixed: vendor fix RHSA-2025:8385
  • Red Hat Enterprise Linux AppStream (v. 9) python3-requests+socks 2.25.1-9.el9, python3-requests+security 2.25.1-9.el9
    fixed: vendor fix RHSA-2025:7049
  • Red Hat Enterprise Linux BaseOS (v. 8) python-requests 2.20.0-5.el8_10, python3-requests 2.20.0-5.el8_10
    fixed: vendor fix RHSA-2025:0012
  • Red Hat Enterprise Linux BaseOS (v. 9) python-requests 2.25.1-9.el9, python3-requests 2.25.1-9.el9
    fixed: vendor fix RHSA-2025:7049
  • Red Hat OpenStack Platform 17.1 python-requests 2.25.1-2.el8ost, python3-requests 2.25.1-2.el8ost
    fixed: vendor fix RHSA-2024:9988
  • Red Hat Satellite 6.16 for RHEL 8 candlepin 4.4.21-1.el8sat, foreman 3.12.0.6-1.el8sat, satellite 6.16.3-2.el8sat, python-jinja2 3.1.5-1.el8pc, python-django 4.2.19-1.el8pc, foreman-cli 3.12.0.6-1.el8sat, +38 more Red Hat Satellite 6.16 for RHEL 9 candlepin 4.4.21-1.el9sat, foreman 3.12.0.6-1.el9sat, satellite 6.16.3-2.el9sat, python-jinja2 3.1.5-1.el9pc, python-django 4.2.19-1.el9pc, foreman-cli 3.12.0.6-1.el9sat, +38 more
    fixed: vendor fix RHSA-2025:2399
  • Red Hat RHUI 4 for RHEL 8 python-requests 2.32.3-2.el8ui, python3.11-requests 2.32.3-2.el8ui
    fixed: vendor fix RHSA-2025:1335
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.4.8-1.el8ap, python39-idna 3.7-1.el8ap, python3x-idna 3.7-1.el8ap, receptorctl 1.4.8-1.el8ap, ansible-core 2.15.11-1.el8ap, ansible-core 2.15.12-1.el8ap, +44 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.4.8-1.el9ap, python-idna 3.7-1.el9ap, python3-idna 3.7-1.el9ap, receptorctl 1.4.8-1.el9ap, python-black 22.8.0-2.el9ap, python-jinja2 3.1.4-1.el9ap, +44 more Red Hat Developer Hub 1 rhdh-operator-container Red Hat Developer Hub 1.2 for RHEL 9 rhdh/rhdh-operator-bundle 1.2-97, rhdh/rhdh-rhel9-operator 1.2-103 Red Hat Discovery 1 discovery-server-container Red Hat Discovery 1.14 discovery 1.14.3-1748529279
    +7 more products
    Red Hat Enterprise Linux 7 python-pip, python3-pip, scap-security-guide Red Hat Enterprise Linux 8 python-pip, python2-pip, python3-pip, python38-pip, python39-pip, python3x-pip, +11 more Red Hat Enterprise Linux 9 python-pip, python3-pip, python3.11-pip, python3.12-pip, rust-srpm-macros, python3-pip-wheel, +3 more Red Hat Enterprise Linux 10 python-pip, python-tornado Red Hat OpenShift Container Platform 4 openshift4/baremetal-hardware-event-proxy-rhel8 Red Hat Software Collections rh-python38-python-pip, rh-python38-python-pip-wheel Red Hat RHUI 4 for RHEL 8 libcomps 0.1.21-1.el8ui, python-jq 1.6.0-4.el8ui, python-xlrd 2.0.1-9.el8ui, python-xlwt 1.3.0-7.el8ui, python-yarl 1.8.2-5.el8ui, python-zipp 3.4.0-8.el8ui, +196 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
15 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
GitHub 3.1 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
OSV 3.1 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi requests
<2.32.0
2.32.0

Affected products

  • psf requests
  • request_project request

Classification

Weakness
  • CWE-670 Always-Incorrect Control Flow Implementation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.