CVE-2026-84381

### Summary httpcore2 does not start TLS for `wss://` connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure `wss` scheme. The transport flaw affects httpcore2 releases before `2.10.0`. HTTPX2 exposed this behavior through its public `Client.websocket()` and `AsyncClient.websocket()` APIs from `2.6.0` through `2.9.1`. ### Details The synchronous and asynchronous SOCKS5 connection implementations upgrade the established proxy tunnel to TLS only when the remote origin scheme is `https`. The equivalent check does not include `wss`. After the SOCKS5 handshake succeeds, the raw stream is therefore passed directly to the HTTP/1.1 connection, which writes the WebSocket upgrade request without first performing a TLS handshake or verifying the destination certificate. For example, an application using HTTPX2 `2.6.0` through `2.9.1` may open an authenticated WebSocket through a SOCKS proxy: ```python import httpx2 with httpx2.Client(proxy="socks5://proxy.example:1080") as client: with client.websocket( "wss://service.example/private?token=query-secret", headers={"Authorization": "Bearer header-secret"}, cookies={"session": "cookie-secret"}, ) as websocket: websocket.send_text("private message") ``` On affected versions, the stream passing through the SOCKS proxy begins with a plaintext request such as: ```text GET /private?token=query-secret HTTP/1.1 Host: service.example Authorization: Bearer header-secret Cookie: session=cookie-secret ``` Before HTTPX2 `2.6.0`, the same underlying httpcore2 behavior could be reached by integrations constructing a WebSocket upgrade request through the low-level transport API, but HTTPX2 did not yet provide its native WebSocket client API. A normal secure WebSocket server will usually reject these plaintext bytes because it expects a TLS ClientHello. However, a m