CVE-2024-35195: Requests `Session` object does not verify requests after making first request with verify=False
Last updated 11 July 2025
Other sources
Requests Session object does not verify requests after making first request with verify=False
— Microsoft
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of verify. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
— NVD
When making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same origin will continue to ignore cert verification regardless of changes to the value of verify. This behavior will continue for the lifecycle of the connection in the connection pool.
Remediation Any of these options can be used to remediate the current issue, we highly recommend upgrading as the preferred mitigation.
Upgrade to requests>=2.32.0. For requests<2.32.0, avoid setting verify=False for the first request to a host while using a Requests Session. For requests<2.32.0, call close() on Session objects to clear existing connections if verify=False is used.
Related Links https://github.com/psf/requests/pull/6655
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/requeststo a version that resolves this vulnerability.Fixed in 2.32.0 - Upgrade
Upgrade
F5 Traffix Systems Signaling Delivery Controllerto a version that resolves this vulnerability.Fixed in 5.2.0 - Upgrade
Upgrade
debian/requeststo a version that resolves this vulnerability.Fixed in 2.32.3+dfsg-5+deb13u1Fixed in 2.32.5+dfsg-1 - Upgrade
Upgrade
redhat/requeststo a version that resolves this vulnerability.Fixed in 2.32.0 - Upgrade
Upgrade
requeststo a version that resolves this vulnerability.Fixed in 2.32.0 - Configuration
If using requests<2.32.0 with a Requests Session, do not set verify=False on the first request to a given host; ensure certificate verification is enabled for that first request so later requests to the same host do not inherit verify=False.
Python Requests Session verify = avoid using verify=False for the first request to a host - Operational
If using requests<2.32.0 and you must use verify=False, call close() on the affected requests.Session object to clear existing connections so subsequent requests do not continue ignoring certificate verification for that host via the connection pool.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35195?
CVE-2024-35195 has been categorized as a moderate severity vulnerability.
How do I fix CVE-2024-35195?
To fix CVE-2024-35195, upgrade the requests library to version 2.32.0 or later.
What versions of Requests are affected by CVE-2024-35195?
CVE-2024-35195 affects all versions of the Requests library prior to 2.32.0.
What is the main issue described in CVE-2024-35195?
The main issue in CVE-2024-35195 is that disabling SSL certificate verification in a Requests session affects all subsequent requests to the same host.
Is CVE-2024-35195 applicable to F5 Traffix SDC products?
Yes, CVE-2024-35195 is applicable to F5 Traffix SDC version 5.1.0 and earlier.