---
id: CVE-2024-35195
aliases:
  - GHSA-9wx4-h78v-vm56
  - PYSEC-2026-1873
title: >-
  Requests `Session` object does not verify requests after making first request
  with verify=False
summary: >-
  Requests `Session` object does not verify requests after making first request
  with verify=False
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N'
vendor: requests
product: requests
ecosystem: pip
affected:
  - requests < 2.32.0
patched:
  - requests 2.32.0
published: '2024-05-20'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:13.740879755Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56'
references:
  - url: 'https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-35195'
  - url: 'https://github.com/psf/requests/pull/6655'
  - url: >-
      https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
  - url: 'https://github.com/psf/requests'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ
tags:
  - osv
  - pip
epss: 0.0034
epssPercentile: 0.24788
ingestedAt: '2026-07-08T18:25:48.109Z'
---

## Overview

When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.

This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.

This behavior affects versions of `requests` prior to 2.32.0.

## Affected packages

- `requests < 2.32.0`

## Remediation

Upgrade to a patched release:

- `requests 2.32.0`