CVE-2024-35195VulnerabilityPublished 13 May 2025Updated 11 Oct 2026

SUSE · security update for python-requests

Affects SUSESource GCVE Database

Not known to be exploited : upgrade to 2.27.0_1 when convenient.

Data as of 25 Oct 2026, 19:02 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 2.27.0_1, 1.1.15_3

Exploitation evidence

Disclosed: evidence found.
CVE published 13 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade locust to 2.27.0_1; onlykey-agent to 1.1.15_3.

Affected software

Product	Affected	Fixed in
Homebrewlocust`pkg:brew/locust`Other threats	Affected >=2.2.1 <2.27.0_1	Fixed in 2.27.0_1
Homebrewonlykey-agent`pkg:brew/onlykey-agent`Other threats	Affected >=1.1.14 <1.1.15_3	Fixed in 1.1.15_3

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released updated python-requests packages that fix this vulnerability. Users of Red Hat OpenStack Platform 17.1 and affected Red Hat Enterprise Linux 8 systems should apply the security update described in Red Hat Security Advisory RHSA-2024:9988. Refer to https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation is required beyond applying the official patch.

Description

When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later. This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity. This behavior affects versions of `requests` prior to 2.32.0.

Impact

The vulnerability causes subsequent HTTP requests to the same host to ignore TLS certificate verification, which can compromise the security of encrypted communications. This could allow attackers to intercept or manipulate data transmitted over HTTPS connections if they can position themselves as a man-in-the-middle. The impact is rated moderate by Red Hat.

Summary

The vulnerability CVE-2024-35195 affects the python-requests library in Red Hat OpenStack Platform 17.1 and related Red Hat products. The flaw causes subsequent HTTP requests to the same host to bypass certificate verification, potentially allowing man-in-the-middle attacks or other TLS-related security issues. Red Hat has acknowledged this issue and provided updated python-requests packages to fix the problem. The advisory references Red Hat Security Advisory RHSA-2024:9988 and provides updated package versions (python-requests-2.25.1-2.el8ost) for Red Hat Enterprise Linux 8 and OpenStack Platform 17.1. No CVSS score is provided, but the vendor rates the impact as moderate.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Jul 2026, 01:23 UTC

WeaknessesCWE-670

Technical details

References

Community reviews

Related threats