{"id":"GHSA-63cx-g855-hvv4","title":"mitmproxy binaries embed a vulnerable python-hyper/h2 dependency","summary":"mitmproxy binaries embed a vulnerable python-hyper/h2 dependency","severity":"medium","vendor":"mitmproxy","product":"mitmproxy","ecosystem":"pip","affected":["mitmproxy < 12.1.2"],"patched":["mitmproxy 12.1.2"],"published":"2025-08-25","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:26.707538775Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-63cx-g855-hvv4","references":[{"url":"https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-63cx-g855-hvv4"},{"url":"https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h"},{"url":"https://github.com/mitmproxy/mitmproxy"}],"tags":["osv","pip"],"ingestedAt":"2026-09-12T03:13:01.663Z","slug":"GHSA-63cx-g855-hvv4","body":"## Overview\n\nmitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to `http://` backends. It does not affect mitmproxy's regular mode.\n\nAll users are encouraged to upgrade to mitmproxy 12.1.2, which includes a fixed version of h2.\n\nMore details about the vulnerability itself can be found at https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h.\n\n## Affected packages\n\n- `mitmproxy < 12.1.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mitmproxy 12.1.2`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}