mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

published 2025-08-25 last yr. modified 2026-09-10 2mo ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

mitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to `http://` backends. It does not affect mitmproxy's regular mode.

All users are encouraged to upgrade to mitmproxy 12.1.2, which includes a fixed version of h2.

More details about the vulnerability itself can be found at https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h.

Patch / fix

fixed in 1

pypi mitmproxy 12.1.2

Is GHSA-63cx-g855-hvv4 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
pypi	mitmproxy	<12.1.2	12.1.2

Classification

Weakness

CWE-1395 Dependency on Vulnerable Third-Party Component
CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

GitHub Advisory GHSA-63cx-g855-hvv4

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.