GitHub Advisoryadvisory · PyPI

GHSA-63cx-g855-hvv4 mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

MEDIUM Published 2025-08-25 Modified 2025-08-25 Official page ↗
Ecosystem
PyPI
Packages
mitmproxy
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Weaknesses
CWE-1395, CWE-444
Reviewed
2025-08-25

Affected packages

• PyPI mitmproxy: < 12.1.2 → fixed in 12.1.2

Description

mitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to `http://` backends. It does not affect mitmproxy's regular mode. All users are encouraged to upgrade to mitmproxy 12.1.2, which includes a fixed version of h2. More details about the vulnerability itself can be found at https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h.

Related

Weakness · CWE (2)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References