CVE-2021-39214: HTTP Request Smuggling in mitmproxy
Summary
CVE-2021-39214: mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. Affects mitmproxy versions < 7.0.3. Fixed in 7.0.3. How to fix ↓
Also tracked for
- mitmproxy · Debian:11
The same CVE-2021-39214 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mitmproxy is an interactive, SSL/TLS-capable intercepting proxy used for testing and debugging HTTP traffic. It allows users to intercept, modify, and inspect HTTP requests and responses. The vulnerability identified as CVE-2021-39214 affects mitmproxy versions 7.0.2 and below. This vulnerability enables a malicious client or server to perform HTTP request smuggling attacks through mitmproxy. By smuggling a request or response through mitmproxy as part of another request or response's HTTP message body, the attacker can bypass access control checks and input sanitization implemented by users. It is important to note that this vulnerability only impacts HTTP/1 services protected by mitmproxy.
Vulnerability Detail
The CVE-2021-39214 vulnerability allows a malicious client or server to smuggle a request or response through mitmproxy as part of another request or response's HTTP message body. This means that the smuggled request or response is captured as part of another request's body but does not appear in the request list and does not go through the usual mitmproxy event hooks. As a result, any custom access control checks or input sanitization implemented by users are bypassed. The impact of this vulnerability depends on the specific implementation and security measures in place for the affected HTTP/1 service.
How To Fix
Latest published version: 12.3.0 as of 22 Oct 2026
pip install --upgrade "mitmproxy==12.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.3
This is the first release that contains the fix.
pip install --upgrade "mitmproxy==7.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to mitmproxy version 7.0.3 or above.
Conclusion
The CVE-2021-39214 vulnerability in mitmproxy allows for HTTP request smuggling attacks, enabling a malicious client or server to bypass access control checks and input sanitization. Upgrading to mitmproxy version 7.0.3 or above is the recommended solution to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for mitmproxy →
FAQ
mitmproxy is an interactive, SSL/TLS-capable intercepting proxy used for testing and debugging HTTP traffic. It allows users to intercept, modify, and inspect HTTP requests and responses.
HTTP request smuggling is a technique where an attacker manipulates the HTTP protocol to bypass security measures and perform unauthorized actions. In the context of mitmproxy, it refers to the ability of a malicious client or server to smuggle a request or response through mitmproxy as part of another request or response's HTTP message body.
CVE-2021-39214 allows a malicious client or server to bypass access control checks and input sanitization implemented by users of mitmproxy. By smuggling a request or response through mitmproxy as part of another request or response's HTTP message body, the attacker can evade detection and potentially perform unauthorized actions.
mitmproxy versions 7.0.2 and below are affected by CVE-2021-39214. Users of these versions should upgrade to mitmproxy 7.0.3 or above to mitigate the vulnerability.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to mitmproxy version 7.0.3 or above.
References
Related vulnerabilities
Recent vulnerabilities recorded for mitmproxy.
