PT-2022-16864 · Mitmproxy+1 · Mitmproxy+1

Zeyu2001 · Published 2022-03-21 · Updated 2025-02-10 · CVE-2022-24766

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mitmproxy versions 7.0.4 and below

Description A malicious client or server can perform HTTP request smuggling attacks through mitmproxy. This means a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.

Recommendations For mitmproxy versions 7.0.4 and below, update to mitmproxy 8.0.0 or above to fix the vulnerability. Unless mitmproxy is used to protect an HTTP/1 service, no action is required.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2022-24766

GHSA-GCX2-GVJ7-PXV3

OPENSUSE-SU-2024:11956-1

OPENSUSE-SU-2025:14762-1

PYSEC-2022-170

Affected Products

Debian

Mitmproxy

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24766.json · Exploit
• https://github.com/mitmproxy/mitmproxy/commit/b06fb6d157087d526bd02e7aadbe37c56865c71b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24766 · Security Note
• https://ubuntu.com/security/CVE-2022-24766 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24766 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14762-1 · Vendor Advisory
• https://mitmproxy.org/posts/releases/mitmproxy8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-24766 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gcx2-gvj7-pxv3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24766 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-170 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24766 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24766 · Security Note
• https://github.com/mitmproxy/mitmproxy · Note
• https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-gcx2-gvj7-pxv3 · Note