PT-2025-36701 · Pypi · Mitmproxy

Published 2025-08-25 · Updated 2025-08-25

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

mitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to http:// backends. It does not affect mitmproxy's regular mode.

All users are encouraged to upgrade to mitmproxy 12.1.2, which includes a fixed version of h2.

More details about the vulnerability itself can be found at https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

CWE-1395

Related Identifiers

GHSA-63CX-G855-HVV4

Affected Products

Mitmproxy

References · 4

• https://osv.dev/vulnerability/GHSA-63cx-g855-hvv4 · Vendor Advisory
• https://github.com/mitmproxy/mitmproxy · Note
• https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-63cx-g855-hvv4 · Note
• https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h · Note