mitmproxy -- Insufficient Protection against HTTP Request Smuggling

Zeyu Zhang reports:

    In mitmproxy 7.0.4 and below, a malicious client or server is able to
    perform HTTP request smuggling attacks through mitmproxy. This means
    that a malicious client/server could smuggle a request/response through
    mitmproxy as part of another request/response's HTTP message body. While
    mitmproxy would only see one request, the target server would see
    multiple requests. A smuggled request is still captured as part of
    another request's body, but it does not appear in the request list and
    does not go through the usual mitmproxy event hooks, where users may
    have implemented custom access control checks or input sanitization.
  

    Unless you use mitmproxy to protect an HTTP/1 service, no action is required.