CVE-2021-39214: Lacking Protection against HTTP Request Smuggling in mitmproxy
Summary
CVE-2021-39214: Lacking Protection against HTTP Request Smuggling in mitmproxy. Affects mitmproxy versions < 7.0.3. Fixed in 7.0.3. How to fix ↓
Also tracked for
- mitmproxy · Debian:11
The same CVE-2021-39214 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mitmproxy is an open-source tool that allows users to intercept, modify, and inspect network traffic. It acts as a proxy server, allowing users to analyze and manipulate HTTP and HTTPS traffic between clients and servers. By intercepting and decrypting SSL/TLS connections, mitmproxy provides a way to inspect encrypted traffic as well. However, versions 7.0.2 and below of mitmproxy are vulnerable to HTTP request smuggling attacks, which can be exploited by malicious clients or servers to smuggle requests or responses through mitmproxy as part of another request or response's HTTP message body. This can lead to multiple requests being sent to the target server, bypassing any custom access control checks or input sanitization implemented by users.
Vulnerability Detail
The vulnerability in mitmproxy allows for HTTP request smuggling attacks, where a malicious client or server can smuggle a request or response through mitmproxy as part of another request or response's HTTP message body. While mitmproxy only sees one request, the target server receives multiple requests. This can lead to security bypasses and potential information disclosure or unauthorized actions. The vulnerability affects mitmproxy versions 7.0.2 and below.
How To Fix
Latest published version: 12.3.0 as of 22 Oct 2026
pip install --upgrade "mitmproxy==12.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.3
This is the first release that contains the fix.
pip install --upgrade "mitmproxy==7.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of mitmproxy as soon as possible.
Conclusion
The vulnerability in mitmproxy allows for HTTP request smuggling attacks, which can lead to security bypasses and potential information disclosure or unauthorized actions. Users are advised to update their mitmproxy installation to the fixed version (7.0.3 and above) to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mitmproxy →
FAQ
mitmproxy is an open-source tool that allows users to intercept, modify, and inspect network traffic. It acts as a proxy server, enabling users to analyze and manipulate HTTP and HTTPS traffic between clients and servers.
HTTP request smuggling is a technique where a malicious client or server manipulates the HTTP protocol to bypass security measures and perform unauthorized actions. In the case of mitmproxy, it allows for smuggling requests or responses through the tool as part of another request or response's HTTP message body.
The vulnerability in mitmproxy can lead to security bypasses, information disclosure, and unauthorized actions. By smuggling requests or responses, an attacker can bypass custom access control checks or input sanitization implemented by users, potentially leading to further exploitation or compromise of the target server.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your mitmproxy installation is affected by this vulnerability. Simply input your Pipfile.lock and the playground will provide real-time monitoring and alerts for open-source vulnerabilities in your software.
No, there is no known workaround for this vulnerability. It is recommended to update to the fixed version of mitmproxy to mitigate the issue.
Related vulnerabilities
Recent vulnerabilities recorded for mitmproxy.
