N/A

CVSS Score

Basic Information

CVE ID

GHSA ID

GHSA-63cx-g855-hvv4

EPSS Score

CWE

CWE-444

Published

8/25/2025

Updated

8/25/2025

KEV Status

Technology

Python

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-63cx-g855-hvv4

GHSA-63cx-g855-hvv4: mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

mitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to http:// backends. It does not affect mitmproxy's regular mode.

All users are encouraged to upgrade to mitmproxy 12.1.2, which includes a fixed version of h2.

More details about the vulnerability itself can be found at https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h.

(GitHub Advisory)

N/A

CVSS Score

Basic Information

CVE ID

GHSA ID

GHSA-63cx-g855-hvv4

EPSS Score

CWE

CWE-444

Published

8/25/2025

Updated

8/25/2025

KEV Status

Technology

Python

Technical Details

CVSS Vector

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mitmproxy	pip	<= 12.1.1	12.1.2

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

mitmproxy **.*.* *n* **low *m*** pyt*on-*yp*r/** ≤ v*.*.*, w*i** **s * **p in its *TTP/* *****r v*li**tion. T*is *n**l*s r*qu*st smu**lin* *tt**ks w**n mitmproxy is in * *on*i*ur*tion w**r* it tr*nsl*t*s *TTP/* to *TTP/*. *or *x*mpl*, t*is *****ts r*

Reasoning

No *n*lysis *v*il**l*

N/A

Basic Information

Concerned about an active attack path?

GHSA-63cx-g855-hvv4: mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

N/A

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI