# CVE-2021-39214: mitmproxy HTTP request smuggling

Source: https://junglewise.ai/threats/cve-2021-39214-mitmproxy-http-request-smuggling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2021-39214 · Severity: low · CVSS 3.1 · Published 2021-09-16

mitmproxy is a proxy tool used to intercept and inspect HTTP/HTTPS traffic for security testing and debugging. In affected versions, a malicious client or server can craft HTTP messages that bypass mitmproxy's inspection, allowing a single request to be interpreted as multiple requests by downstream servers. This enables attackers to evade custom security controls, input validation, and access checks that mitmproxy users may have configured.

Technologies: [mitmproxy (PyPI)](https://junglewise.ai/threats/technologies/mitmproxy). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-39214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-39214 being exploited in the wild.

**How severe is CVE-2021-39214?** Low severity, with a CVSS score of 3.1, published 16 September 2021.

**Which products and versions are affected?** mitmproxy (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.3.

**Is there a fix for CVE-2021-39214?** Yes. mitmproxy (PyPI): upgrade to 7.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-39214 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-39214?** Check whether you run mitmproxy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mitmproxy (PyPI): upgrade to 7.0.3 or later

  ```sh
  pip install "mitmproxy>=7.0.3"
  ```


## Technical details

This vulnerability is an HTTP request smuggling flaw (CWE-444) arising from inconsistent HTTP message parsing between mitmproxy and backend servers. A malicious client or server can craft ambiguous HTTP/1.1 messages (leveraging differences in Transfer-Encoding and Content-Length interpretation, and also HTTP/2 scenarios like H2.TE/H2.CL attacks) that mitmproxy parses as one request but which downstream HTTP/1 services parse as multiple requests. The smuggled request is embedded within another request's body, remains invisible in mitmproxy's request list, and bypasses event hooks where users may have implemented access control or sanitization logic. No authentication is required; the attack is network-based and can originate from any HTTP client or server. The vulnerability affects mitmproxy 7.0.2 and earlier versions across all previous releases (0.x through 7.0.2), and was patched in version 7.0.3.

## Affected products

- mitmproxy mitmproxy <=7.0.2

## Identifiers

- CVE-2021-39214
- GHSA-22gh-3r9q-xf38
- PYSEC-2021-328

## Timeline

- 2021-09-16: disclosed: Advisory published
- 2021-09-16: patched: Fix released in mitmproxy 7.0.3 and above

## References

- [https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-22gh-3r9q-xf38](https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-22gh-3r9q-xf38)

## Related threats

- [PYSEC-2026-1630 - Mitmweb API Authentication Bypass Using Proxy Server](https://junglewise.ai/threats/cve-2025-23217-mitmweb-api-authentication-bypass-using-proxy-server)
- [mitmproxy LDAP injection in LDAP proxy authentication](https://junglewise.ai/threats/cve-2026-40606-mitmproxy-ldap-injection-in-ldap-proxy-authentication)
- [mitmproxy binaries embed a vulnerable python-hyper/h2 dependency](https://junglewise.ai/threats/mitmproxy-binaries-embed-a-vulnerable-python-hyper-h2-dependency-e14cde4e)
- [Insufficient Protection against HTTP Request Smuggling in mitmproxy](https://junglewise.ai/threats/cve-2022-24766-insufficient-protection-against-http-request-smuggling-in)
- [PYSEC-2018-56 - mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py.](https://junglewise.ai/threats/cve-2018-14505-mitmweb-in-mitmproxy-allows-dns-rebinding-attacks)