Homepage
About Snyk

mitmproxy@6.0.0 vulnerabilities

An interactive, SSL/TLS-capable intercepting proxy for HTTP/1, HTTP/2, and WebSockets.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the mitmproxy package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
HTTP Request Smuggling

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.

Affected versions of this package are vulnerable to HTTP Request Smuggling via another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.

How to fix HTTP Request Smuggling?

Upgrade mitmproxy to version 8.0.0 or higher.

[,8.0.0)
  • H
HTTP Request Smuggling

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.

Affected versions of this package are vulnerable to HTTP Request Smuggling. A malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests.

How to fix HTTP Request Smuggling?

Upgrade mitmproxy to version 7.0.3 or higher.

[,7.0.3)
Go back to all versions of this package