Inconsistent interpretation of HTTP requests in mitmproxy - CVE-2025-57804

Vulnerability identifier: #VU114414

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-57804

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/2 requests in the embed python-hyper/h2 component when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

mitmproxy
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Python 3 Module
Server Applications Module
openSUSE Leap
openEuler
Maximo Application Suite - Visual Inspection Component
python3-h2
python-h2
python-h2-help
python311-h2

Install updates from vendor's website.

mitmproxy - update to 12.1.2
Maximo Application Suite - Visual Inspection Component - update to 9.1.18
python3-h2 - update to 3.2.0-150200.3.5.1
python-h2 - update to 4.1.0-3
python-h2-help - update to 4.1.0-3
python3-h2 - update to 4.1.0-3
python311-h2 - update to 4.1.0-150400.8.6.1

• https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-63cx-g855-hvv4

• HTTP request smuggling in mitmproxy
• openEuler update for python-h2
• SUSE update for python-h2
• SUSE update for python-h2
• IBM Maximo Application Suite - Visual Inspection Component update for h2