Read the docs
TI-2021-16599 Aliases CVE-2021-39214GHSA-22gh-3r9q-xf38

Lacking Protection against HTTP Request Smuggling in mitmproxy

Priority MEDIUM 44CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While a smuggled request is still captured as part of another request's body, it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization. Unless one uses mitmproxy to protect an HTTP/1 service, no action is required. The vulnerability has been fixed in mitmproxy 7.0.3 and above.

Why it matters now

EPSS 0.01055 64th percentileScored 2026-11-07
Fix Fixed mitmproxy (mitmproxy): 7.0.3mitmproxy (PyPI): 7.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
mitmproxymitmproxybefore 7.0.37.0.3Patch availableCNA
—mitmproxy (PyPI)before 7.0.37.0.3Patch availableGHSA-22gh-3r9q-xf38
  • mitmproxy Vendormitmproxy Affected before 7.0.3 Fixed in 7.0.3 Patch available CNA
  • mitmproxy (PyPI) Vendor— Affected before 7.0.3 Fixed in 7.0.3 Patch available GHSA-22gh-3r9q-xf38

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mitmproxy:mitmproxy:*:*:*:*:*:*:*:*up to 7.0.2Vulnerablemitmproxy
  • cpe:2.3:a:mitmproxy:mitmproxy:*:*:*:*:*:*:*:* Versions up to 7.0.2 Vulnerable ·mitmproxy

Remediation

  • Fix · CNA mitmproxy (mitmproxy) Fixed in 7.0.3
  • Fix · GHSA-22gh-3r9q-xf38 mitmproxy (PyPI) Fixed in 7.0.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39214
  2. 2026-10-03 Alias added: GHSA-22gh-3r9q-xf38

References

Advisory 2

Other 2

  • TI-2022-08580 Insufficient Protection against HTTP Request Smuggling in mitmproxy CVSS 3.1CRITICAL 9.8
  • TI-2018-10406 mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py. CVSS 3.0HIGH 8.8
  • TI-2026-29342 ProxyAuth Addon LDAP Injection in mitmproxy CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences