CVE-2023-48052: HTTPie SSL Certificate Validation Bypass
Summary
CVE-2023-48052: Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack. Affects httpie versions < 3.2.3. Fixed in 3.2.3. How to fix ↓
Also tracked for
- httpie · Debian:12
The same CVE-2023-48052 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HTTPie is a command-line tool for making HTTP requests. It provides a simple and intuitive interface for interacting with HTTP servers. The package is available on PyPI and is widely used by developers for testing APIs and debugging network issues. However, HTTPie versions up to 3.2.2 are vulnerable to a SSL certificate validation bypass, which can be exploited by attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
Vulnerability Detail
The vulnerability in HTTPie arises from the lack of SSL certificate validation. When making requests to servers over HTTPS, HTTPie fails to properly validate the server's SSL certificate, allowing an attacker to intercept and eavesdrop on the communication. This can lead to the exposure of sensitive information, such as authentication credentials or private data. The vulnerability has a moderate severity rating.
How To Fix
Latest published version: 3.2.4 as of 22 Oct 2026
pip install --upgrade "httpie==3.2.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.3
This is the first release that contains the fix.
pip install --upgrade "httpie==3.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a patched version of HTTPie to ensure the proper SSL certificate validation.
Conclusion
In conclusion, HTTPie versions up to 3.2.2 are vulnerable to a SSL certificate validation bypass, which can be exploited by attackers to eavesdrop on communications. It is crucial to update to a patched version of HTTPie to ensure the proper SSL certificate validation and mitigate the risk of interception and exposure of sensitive information. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for httpie →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your version of HTTPie is affected by this vulnerability. Simply enter your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this SSL certificate validation bypass.
The SSL certificate validation bypass in HTTPie can allow attackers to intercept and eavesdrop on communications between the host and server. This can lead to the exposure of sensitive information, such as authentication credentials or private data.
No, only versions up to 3.2.2 of HTTPie are affected by this SSL certificate validation bypass. It is recommended to update to a patched version to mitigate the vulnerability.
There is no known public exploit for this vulnerability at the time of this advisory. However, it is crucial to update to a patched version of HTTPie to prevent potential exploitation.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-8r96-8889-qg2x at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-8r96-8889-qg2x/GHSA-8r96-8889-qg2x.json
References
Related vulnerabilities
Recent vulnerabilities recorded for httpie.
