The vulnerability CVE-2024-35195 in the python-requests library causes subsequent requests to the same host to bypass certificate verification, which can weaken the security guarantees of TLS connections. This issue is classified under CWE-670 (Improper Resource Shutdown or Release). Red Hat has released an updated python-requests package for Red Hat Enterprise Linux 9 to fix this problem. The update is available across various supported architectures and extended update support versions. No CVSS score is provided, but the vendor rates the impact as moderate.

The vulnerability allows subsequent requests to the same host to ignore TLS certificate verification, potentially enabling man-in-the-middle attacks or interception of sensitive data if an attacker can position themselves in the network path. This undermines the trust model of HTTPS connections made via python-requests on affected Red Hat Enterprise Linux 9 systems. However, no known exploits in the wild have been reported, and the severity is rated moderate by Red Hat.

Red Hat has released an official security update for python-requests that addresses this vulnerability. Users of Red Hat Enterprise Linux 9 and its variants should apply the update as described in the Red Hat advisory RHSA-2025:7049 and the referenced article https://access.redhat.com/articles/11258. Applying this update fully mitigates the issue. No additional mitigation steps are indicated by the vendor.