CVE-2018-14505: Mitmweb in mitmproxy allows DNS Rebinding attacks
Summary
CVE-2018-14505: Mitmweb in mitmproxy allows DNS Rebinding attacks. Affects mitmproxy versions < 4.0.4. Fixed in 4.0.4. How to fix ↓
Also tracked for
- mitmproxy · Debian:11
The same CVE-2018-14505 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mitmproxy is a powerful tool used for intercepting, modifying, and inspecting network traffic. It provides a web-based interface called mitmweb, which allows users to interact with mitmproxy through a browser. Mitmproxy is widely used for security testing, debugging, and privacy analysis. However, prior to version 4.0.4, mitmweb was vulnerable to DNS Rebinding attacks, which could have severe consequences for the security and integrity of network communications.
Vulnerability Detail
The vulnerability in mitmweb allowed for DNS Rebinding attacks. DNS Rebinding is a technique where an attacker tricks a victim's browser into making requests to a malicious website, bypassing the browser's same-origin policy. This can lead to various security issues, such as unauthorized access to sensitive information, session hijacking, and remote code execution. The vulnerability was present in the 'tools/web/app.py' file of mitmproxy. Exploiting this vulnerability could have serious implications for users relying on mitmweb for network analysis and interception.
How To Fix
Latest published version: 12.3.0 as of 22 Oct 2026
pip install --upgrade "mitmproxy==12.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.4
This is the first release that contains the fix.
pip install --upgrade "mitmproxy==4.0.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Mitmweb in mitmproxy prior to version 4.0.4 was vulnerable to DNS Rebinding attacks, which could have serious security implications. Users are advised to update mitmproxy to version 4.0.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mitmproxy →
FAQ
Mitmproxy is a powerful tool used for intercepting, modifying, and inspecting network traffic. It provides a web-based interface called mitmweb, which allows users to interact with mitmproxy through a browser.
DNS Rebinding is a technique where an attacker tricks a victim's browser into making requests to a malicious website, bypassing the browser's same-origin policy.
DNS Rebinding attacks can lead to various security issues, such as unauthorized access to sensitive information, session hijacking, and remote code execution.
To fix the vulnerability, update mitmproxy to version 4.0.4 or later by running the command 'pip install --upgrade mitmproxy'.
No, there is no known workaround for this vulnerability. It is recommended to update mitmproxy to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for mitmproxy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
