CVE-2024-35195 - CVE House
Back to Database
Status published Medium CVE-2024-35195

Requests `Session` object does not verify requests after making first request with verify=False

Vulnerability Description

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-35195

Credits & Attribution

No credits recorded in the NVD database.

References

More from psf

View All →
CVE-2024-47081
Requests vulnerable to .netrc credentials leak via malicious URLs
Medium 5.3
CVE-2024-1682
Unclaimed S3 Bucket Reference in psf/requests Documentation
Medium 4.3
CVE-2023-32681
Unintended leak of Proxy-Authorization header in requests
Medium 6.1

Affected Vendor

Affected Software

requests
Vulnerable Versions:
< 2.32.0

Timeline

Official Publish: May 20th, 2024
Last Modified: July 31st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-670

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.