Read the docs
TI-2022-08580 Aliases CVE-2022-24766GHSA-gcx2-gvj7-pxv3

Insufficient Protection against HTTP Request Smuggling in mitmproxy

Priority MEDIUM 52CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization. Unless mitmproxy is used to protect an HTTP/1 service, no action is required. The vulnerability has been fixed in mitmproxy 8.0.0 and above. There are currently no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01633 76th percentileScored 2026-11-07
Fix Fixed mitmproxy (PyPI): 8.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mitmproxymitmproxyup to 7.0.4—No fix listedCNA
—mitmproxy (PyPI)before 8.0.08.0.0Patch availableGHSA-gcx2-gvj7-pxv3
  • mitmproxy Vendormitmproxy Affected up to 7.0.4 Fixed in — No fix listed CNA
  • mitmproxy (PyPI) Vendor— Affected before 8.0.0 Fixed in 8.0.0 Patch available GHSA-gcx2-gvj7-pxv3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mitmproxy:mitmproxy:*:*:*:*:*:*:*:*up to 7.0.4Vulnerablemitmproxy
  • cpe:2.3:a:mitmproxy:mitmproxy:*:*:*:*:*:*:*:* Versions up to 7.0.4 Vulnerable ·mitmproxy

Remediation

  • Fix · GHSA-gcx2-gvj7-pxv3 mitmproxy (PyPI) Fixed in 8.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24766
  2. 2026-10-03 Alias added: GHSA-gcx2-gvj7-pxv3

References

Patch 1

Advisory 3

Other 3

  • TI-2021-16599 Lacking Protection against HTTP Request Smuggling in mitmproxy CVSS 3.1CRITICAL 9.8
  • TI-2018-10406 mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py. CVSS 3.0HIGH 8.8
  • TI-2026-29342 ProxyAuth Addon LDAP Injection in mitmproxy CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences