{"id":"CVE-2023-48052","aliases":["GHSA-8r96-8889-qg2x","PYSEC-2023-242"],"title":"HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack","summary":"HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","vendor":"httpie","product":"httpie","ecosystem":"pip","affected":["httpie < 3.2.3"],"patched":["httpie 3.2.3"],"published":"2023-11-16","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:58.880686355Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8r96-8889-qg2x","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48052"},{"url":"https://github.com/httpie/cli/issues/1549"},{"url":"https://github.com/httpie/cli/commit/7f03c52d2237440c5a672296ce6955aae4ed4f09"},{"url":"https://github.com/httpie/cli"},{"url":"https://github.com/httpie/cli/blob/master/httpie/client.py#L33"},{"url":"https://github.com/httpie/cli/blob/master/httpie/internal/update_warnings.py#L44"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/httpie/PYSEC-2023-242.yaml"},{"url":"https://gxx777.github.io/HTTPie_3.2.2_Cryptographic_API_Misuse_Vulnerability.md"}],"tags":["osv","pip"],"epss":0.00307,"epssPercentile":0.2374,"ingestedAt":"2026-09-12T03:13:01.679Z","slug":"CVE-2023-48052","body":"## Overview\n\nMissing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.\n\n## Affected packages\n\n- `httpie < 3.2.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `httpie 3.2.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}