CVE-2022-24766: HTTP Request Smuggling in mitmproxy
Summary
CVE-2022-24766: mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. Affects mitmproxy across 2 version ranges.
< 8.0.0
< b06fb6d157087d526bd02e7aadbe37c56865c71b
Fixed in b06fb6d157087d526bd02e7aadbe37c56865c71b. How to fix ↓
Also tracked for
- mitmproxy · Debian:11
The same CVE-2022-24766 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mitmproxy is an interactive, SSL/TLS-capable intercepting proxy used for HTTP traffic analysis and manipulation. It allows users to intercept, inspect, modify, and replay HTTP requests and responses. The vulnerability in mitmproxy version 7.0.4 and below enables malicious clients or servers to perform HTTP request smuggling attacks. This means that an attacker can smuggle a request or response through mitmproxy as part of another request or response's HTTP message body. While mitmproxy only sees one request, the target server receives multiple requests. Smuggled requests are not visible in the request list and bypass any custom access control checks or input sanitization implemented by users. The vulnerability has been addressed in mitmproxy version 8.0.0 and above.
Vulnerability Detail
The vulnerability in mitmproxy allows for HTTP request smuggling attacks. By exploiting this vulnerability, a malicious client or server can smuggle a request or response through mitmproxy as part of another request or response's HTTP message body. This can lead to various security issues, such as bypassing access controls, injecting malicious content, or performing unauthorized actions on the target server. It is important to note that this vulnerability only affects mitmproxy versions 7.0.4 and below. Users of mitmproxy are advised to upgrade to version 8.0.0 or above to mitigate this vulnerability.
How To Fix
Latest published version: 12.3.0 as of 22 Oct 2026
pip install --upgrade "mitmproxy==12.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
b06fb6d157087d526bd02e7aadbe37c56865c71b
This is the first release that contains the fix.
pip install --upgrade "mitmproxy==b06fb6d157087d526bd02e7aadbe37c56865c71b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in mitmproxy versions 7.0.4 and below allows for HTTP request smuggling attacks. Users of mitmproxy are advised to upgrade to version 8.0.0 or above to mitigate this vulnerability. Regularly checking for updates and applying them promptly is crucial to maintain the security of the mitmproxy installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mitmproxy →
FAQ
mitmproxy is an interactive, SSL/TLS-capable intercepting proxy used for HTTP traffic analysis and manipulation. It allows users to intercept, inspect, modify, and replay HTTP requests and responses.
HTTP request smuggling is a technique where an attacker can manipulate the interpretation of HTTP requests by the proxy or server, leading to security vulnerabilities. In the case of mitmproxy, it allows a malicious client or server to smuggle a request or response through mitmproxy as part of another request or response's HTTP message body.
Exploiting this vulnerability can lead to various security issues, such as bypassing access controls, injecting malicious content, or performing unauthorized actions on the target server.
The vulnerability affects mitmproxy versions 7.0.4 and below. Versions 8.0.0 and above have addressed this vulnerability.
To mitigate this vulnerability, it is recommended to upgrade to mitmproxy version 8.0.0 or above. Regularly checking for updates and applying them promptly is essential to ensure the security of the mitmproxy installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for mitmproxy.
