CVE-2023-48052 HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack
Attackers can intercept sensitive data via man-in-the-middle attacks due to missing SSL certificate validation in HTTPie.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-48052?
CVE-2023-48052 is a high-severity vulnerability in n/a, published on 16 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
Which versions are affected by CVE-2023-48052?
3 open source packages ship an affected version, including httpie. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
httpie PyPI | All versions | None |
httpie PyPI | All versions | 3.2.3 |
httpie PyPI | All versions | 3.2.3 |
Products include Httpie Httpie.
How do I fix CVE-2023-48052?
Upgrade httpie to 3.2.3 or later.
Is CVE-2023-48052 being exploited?
There is no known exploitation of CVE-2023-48052 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2023-48052, GHSA-8r96-8889-qg2x, OESA-2025-2356, OESA-2025-2357, OESA-2025-2358, PYSEC-2023-242 and 1 more.