{"id":"CVE-2025-67485","title":"mad-proxy is a Python-based HTTP/HTTPS proxy server for detection and blocking of malicious web activity using custom security policies","summary":"mad-proxy is a Python-based HTTP/HTTPS proxy server for detection and blocking of malicious web activity using custom security policies. Versions 0.3 and below allow attackers to bypass HTTP/HTTPS traffic interception rules, potentially …","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-693"],"vendor":"machphy","product":"mad-proxy","affected":["mad-proxy <= 0.3"],"published":"2025-12-10","updated":"2026-10-14","sourceUpdated":"2026-10-14T21:10:00.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-67485","references":[{"url":"https://github.com/machphy/mad-proxy/security/advisories/GHSA-wx63-35hw-2482","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67485"},{"url":"https://github.com/machphy/mad-proxy"}],"tags":["nvd","osv","pip"],"epss":0.00244,"epssPercentile":0.15508,"aliases":["GHSA-wx63-35hw-2482","PYSEC-2026-1596"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:53.927Z","slug":"CVE-2025-67485","body":"## Overview\n\nmad-proxy is a Python-based HTTP/HTTPS proxy server for detection and blocking of malicious web activity using custom security policies. Versions 0.3 and below allow attackers to bypass HTTP/HTTPS traffic interception rules, potentially exposing sensitive traffic. This issue does not have a fix at the time of publication.\n\n## Affected\n\n- `mad-proxy <= 0.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-67485)\n\nAffected packages:\n\n- `mad-proxy <= 0.3`\n\nSource: https://osv.dev/vulnerability/GHSA-wx63-35hw-2482","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}