before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1…
Priority LOW 36CWE-697Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).
Why it matters now
EPSS 0.01694 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed proxy.py (PyPI): 2.3.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | proxy.py (PyPI) | before 2.3.1 | 2.3.1 | Patch available | GHSA-cmc7-mfmr-xqrx |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- proxy.py (PyPI) Vendor— Affected before 2.3.1 Fixed in 2.3.1 Patch available GHSA-cmc7-mfmr-xqrx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:proxy.py_project:proxy.py:*:*:*:*:*:*:*:* | before 2.3.1 | Vulnerable | Proxy.py Project |
- cpe:2.3:a:proxy.py_project:proxy.py:*:*:*:*:*:*:*:* Versions before 2.3.1 Vulnerable ·Proxy.py Project
Remediation
- Fix · GHSA-cmc7-mfmr-xqrx proxy.py (PyPI) Fixed in 2.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3116
- 2026-10-03 Alias added: GHSA-cmc7-mfmr-xqrx
References
Patch 1
Advisory 2
Other 6
- https://pypi.org/project/proxy.py/2.3.1/#history
- https://github.com/abhinavsingh/proxy.py/pull/482
- https://github.com/abhinavsingh/proxy.py/commit/bff171ec26d826ae1d22d2466eaf9d8bdbf059d3
- https://cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication
- https://github.com/abhinavsingh/proxy.py
- https://github.com/pypa/advisory-database/tree/main/vulns/proxy-py/PYSEC-2021-46.yaml
Sources
- CVE-2021-3116 · CVE Program
- CVE-2021-3116 · NVD
- FIRST EPSS
- GHSA-cmc7-mfmr-xqrx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences