CVE-2025-67485

HTTP/HTTPS Traffic Interception Bypass in mad-proxy

State: Published
Severity: 5.3 Medium
Published: Dec 10, 2025
Updated: Dec 10, 2025
Reserved: Dec 8, 2025

Description

mad-proxy is a Python-based HTTP/HTTPS proxy server for detection and blocking of malicious web activity using custom security policies. Versions 0.3 and below allow attackers to bypass HTTP/HTTPS traffic interception rules, potentially exposing sensitive traffic. This issue does not have a fix at the time of publication.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-693 Protection Mechanism Failure

Affected Products

Product	Versions
mad-proxymachphy	<= 0.3Affected

References

https://github.com/machphy/mad-proxy/security/advisories/GHSA-wx63-35hw-2482

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.