CVE-2022-24766: Insufficient Protection against HTTP Request Smuggling in mitmproxy
Summary
CVE-2022-24766: Insufficient Protection against HTTP Request Smuggling in mitmproxy. Affects mitmproxy versions < 8.0.0. Fixed in 8.0.0. How to fix ↓
Also tracked for
- mitmproxy · Debian:11
The same CVE-2022-24766 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mitmproxy is an open-source tool that allows users to intercept, inspect, modify, and replay HTTP and HTTPS traffic. It acts as a proxy server, allowing users to analyze and manipulate network traffic between clients and servers. However, versions 7.0.4 and below of mitmproxy are vulnerable to HTTP request smuggling attacks, which can be exploited by malicious clients or servers. This vulnerability allows smuggled requests to bypass normal event hooks and custom access control checks implemented by users, potentially leading to unauthorized access or data manipulation.
Vulnerability Detail
The vulnerability in mitmproxy arises from its inability to adequately protect against HTTP request smuggling attacks. A malicious client or server can exploit this vulnerability to smuggle a request or response through mitmproxy as part of another request or response's HTTP message body. While mitmproxy only sees one request, the target server receives multiple requests. This can lead to various security issues, such as bypassing access controls, injecting malicious content, or manipulating data. It is important to note that this vulnerability only affects mitmproxy when used to protect an HTTP/1 service.
How To Fix
Latest published version: 12.3.0 as of 22 Oct 2026
pip install --upgrade "mitmproxy==12.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.0.0
This is the first release that contains the fix.
pip install --upgrade "mitmproxy==8.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can consider temporarily discontinuing the use of mitmproxy or implementing additional security measures, such as using alternative proxy tools or ensuring the underlying HTTP/1 service is adequately protected.
Conclusion
The vulnerability in mitmproxy exposes users to the risk of HTTP request smuggling attacks. It is crucial for users to update their installations to the latest version (8.0.0 and above) to mitigate this vulnerability. Additionally, considering alternative proxy tools or implementing additional security measures can help minimize the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mitmproxy →
FAQ
mitmproxy is an open-source tool that allows users to intercept, inspect, modify, and replay HTTP and HTTPS traffic. It acts as a proxy server, enabling users to analyze and manipulate network traffic between clients and servers.
HTTP request smuggling is a technique where a malicious client or server manipulates the HTTP protocol to bypass security controls or perform unauthorized actions. It involves exploiting inconsistencies in how different components interpret and process HTTP requests.
The vulnerability in mitmproxy allows malicious clients or servers to perform HTTP request smuggling attacks. This can lead to unauthorized access, data manipulation, or bypassing of access controls. It is important to note that this vulnerability only affects mitmproxy when used to protect an HTTP/1 service.
Yes, the vulnerability has been fixed in mitmproxy version 8.0.0 and above. Users are advised to update their installations to the latest version to mitigate the risk of HTTP request smuggling attacks.
While there is no specific workaround mentioned for this vulnerability, users can consider temporarily discontinuing the use of mitmproxy or implementing additional security measures, such as using alternative proxy tools or ensuring the underlying HTTP/1 service is adequately protected.
References
Related vulnerabilities
Recent vulnerabilities recorded for mitmproxy.
