GHSA-63CX-G855-HVV4 vulnerabilities

Vulnerabilities for packages: mitmproxy...

GHSA-WG33-5H85-7Q5P vulnerabilities

Vulnerabilities for packages: mitmproxy...

CVE-2023-23931 vulnerabilities

Vulnerabilities for packages: mitmproxy...

CVE-2025-23217 vulnerabilities

Vulnerabilities for packages: mitmproxy...

GHSA-W7PP-M8WF-VJ6R vulnerabilities

Vulnerabilities for packages: mitmproxy...

CVE-2023-23931 vulnerabilities

Vulnerabilities for packages: mitmproxy...

GHSA-63CX-G855-HVV4 vulnerabilities

Vulnerabilities for packages: mitmproxy...

CVE-2025-23217 vulnerabilities

Vulnerabilities for packages: mitmproxy...

GHSA-W7PP-M8WF-VJ6R vulnerabilities

Vulnerabilities for packages: mitmproxy...

GHSA-WG33-5H85-7Q5P vulnerabilities

Vulnerabilities for packages: mitmproxy...

EUVD-2018-0100

Malware in sbrugna...

EUVD-2021-0135

Malware in sbrugna...

EUVD-2025-3147

Malicious code in bioql PyPI...

EUVD-2025-29450

Malicious code in bioql PyPI...

EUVD-2022-0156

Malicious code in bioql PyPI...

HTTP Request Smuggling (HRS)

mitmproxy is vulnerable to HTTP request smuggling. The vulnerability is due to mitmproxy embedding python-hyper/h2 ≤ v4.2.0 which has a gap in its HTTP/2 header validation, which allows an attacker to smuggle requests when mitmproxy translates HTTP/2 to HTTP/1...

Linux Distros Unpatched Vulnerability : CVE-2018-14505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py. CVE-2018-14505 Note that Nessus relies on the presence of the package as...

GHSA-63CX-G855-HVV4 mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

mitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to http:// backends. It does not...

mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

mitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to http:// backends. It does not...

Mozilla: Microsoft `x-apikey` Exposed in Mozilla CI Public Logs

A Microsoft telemetry API key x-apikey was found exposed in publicly accessible Mozilla CI logs. The key appeared in HTTP POST requests sent to Microsoft's telemetry endpoint during automated Firefox testing and was captured via mitmproxy logs. The security impact was considered minimal as the...