{"id":"ffbaf4126583a501","repo":"psf/requests","slug":"old-version-of-cryptography-cryptography-version","errorCode":null,"errorMessage":"Old version of cryptography ({cryptography_version_list}) may cause slowdown.","messagePattern":"Old version of cryptography \\((.+?)\\) may cause slowdown\\.","errorType":"console","errorClass":"RequestsDependencyWarning","httpStatus":null,"severity":"info","filePath":"src/requests/__init__.py","lineNumber":108,"sourceCode":"        assert (2, 0, 0) <= (major, minor, patch) < (4, 0, 0)\n    else:\n        warnings.warn(\n            \"Unable to find acceptable character detection dependency \"\n            \"(chardet or charset_normalizer).\",\n            RequestsDependencyWarning,\n        )\n\n\ndef _check_cryptography(cryptography_version: str) -> None:\n    # cryptography < 1.3.4\n    try:\n        cryptography_version_list = list(map(int, cryptography_version.split(\".\")))\n    except ValueError:\n        return\n\n    if cryptography_version_list < [1, 3, 4]:\n        warning = f\"Old version of cryptography ({cryptography_version_list}) may cause slowdown.\"\n        warnings.warn(warning, RequestsDependencyWarning)\n\n\n# Check imported dependencies for compatibility.\ntry:\n    check_compatibility(\n        urllib3.__version__,\n        chardet_version,\n        charset_normalizer_version,\n    )\nexcept (AssertionError, ValueError):\n    warnings.warn(\n        f\"urllib3 ({urllib3.__version__}) or chardet \"\n        f\"({chardet_version})/charset_normalizer ({charset_normalizer_version}) \"\n        \"doesn't match a supported version!\",\n        RequestsDependencyWarning,\n    )\n\n# Attempt to enable urllib3's fallback for SNI support","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/psf/requests/blob/414f0513c33883adf6f2b46901d4f0b38a455851/src/requests/__init__.py#L90-L126","documentation":"A `RequestsDependencyWarning` emitted at import time from `_check_cryptography()` in `src/requests/__init__.py:107`. When pyOpenSSL support is in play, requests checks the installed `cryptography` package version; versions older than 1.3.4 had known performance problems (notably slow random-number/OpenSSL initialization), so requests warns that TLS operations may be slow. It is advisory only — nothing fails.","triggerScenarios":"`import requests` in an environment where the pyOpenSSL/urllib3-contrib path is active and `cryptography.__version__` parses to a version list < [1, 3, 4]. Unparseable versions (e.g. dev builds with suffixes causing ValueError) skip the check silently.","commonSituations":"Very old pinned environments (legacy Python 2/early Python 3 era system packages), ancient OS-distribution `python-cryptography` packages on long-lived servers, requirements files pinning `cryptography<1.3.4` for compatibility with other legacy libraries.","solutions":["Upgrade cryptography: `pip install --upgrade cryptography` — any modern version (well above 1.3.4) removes the warning and the slowdown.","If a system package is shadowing a newer pip install, remove or bypass it (use a virtualenv so the old distro package isn't imported).","If the environment truly cannot upgrade, the warning can be filtered with `warnings.filterwarnings('ignore', category=RequestsDependencyWarning)`, accepting slower TLS."],"exampleFix":"# before\n# requirements.txt: cryptography==1.2.3\n# after\n# requirements.txt: cryptography>=42.0\n# then: pip install --upgrade cryptography","handlingStrategy":"fallback","validationCode":"import cryptography\nfrom packaging.version import Version\nassert Version(cryptography.__version__) >= Version('1.3.4'), 'Upgrade cryptography: pip install -U cryptography'","typeGuard":null,"tryCatchPattern":"import warnings\nwith warnings.catch_warnings():\n    warnings.simplefilter('error', category=RequestsDependencyWarning)\n    import requests  # surface the old-cryptography warning as an error in CI","preventionTips":["This is a warning, not an exception — requests still works, just slower with pyOpenSSL","Upgrade cryptography (pip install -U cryptography) or remove the pyOpenSSL injection if unneeded","Treat RequestsDependencyWarning as an error in CI so outdated TLS stacks are caught before deploy","Keep urllib3/pyOpenSSL/cryptography versions aligned via a lock file"],"tags":["dependency","cryptography","tls","performance","python","requests"],"analyzedSha":"414f0513c33883adf6f2b46901d4f0b38a455851","analyzedAt":"2026-07-31T19:24:57.696Z","schemaVersion":2}