João Sobral

**Name of the Vulnerable Software and Affected Versions** mitmproxy versions 7.0.2 and below **Description** A malicious client or server can perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While a smuggled request is still captured as part of another request's body, it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization. **Recommendations** For mitmproxy versions 7.0.2 and below, update to mitmproxy 7.0.3 or above to fix the vulnerability. Unless mitmproxy is used to protect an HTTP/1 service, no action is required. As a temporary workaround, consider restricting access to the HTTP message body to minimize the risk of exploitation.