Vulnerability · Published Aug 29, 2025 · Assigned by GitHub_M
CVE-2025-58068Eventlet affected by HTTP request smuggling in unparsed trailers
Medium 6.3
In plain English
A medium-severity security flaw in eventlet from eventlet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-eventlet | no fix listed | DEBIAN-CVE-2025-58068 |
| Debian:13 | python-eventlet | 0.39.1-2+deb13u1 | DEBIAN-CVE-2025-58068 |
| Debian:14 | python-eventlet | 0.40.1-3 | DEBIAN-CVE-2025-58068 |
| PyPI | eventlet | 0.40.3 | GHSA-hw6f-rjfj-j7j7 |
| PyPI | eventlet | 0.40.3 | PYSEC-2026-1350 |
| Ubuntu:22.04:LTS | python-eventlet | 0.30.2-5ubuntu2.2 | USN-7772-1 |
| Ubuntu:22.04:LTS | python-eventlet | 0.30.2-5ubuntu2.2 | UBUNTU-CVE-2025-58068 |
| Ubuntu:24.04:LTS | python-eventlet | 0.35.2-0ubuntu1.1 | UBUNTU-CVE-2025-58068 |
| Ubuntu:24.04:LTS | python-eventlet | 0.35.2-0ubuntu1.1 | USN-7772-1 |
| Ubuntu:25.10 | python-eventlet | 0.39.0-0ubuntu2 | UBUNTU-CVE-2025-58068 |
| Ubuntu:26.04:LTS | python-eventlet | 0.39.0-0ubuntu2 | UBUNTU-CVE-2025-58068 |
Affected products (as reported)
Weakness: CWE-444 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References
- https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7 x_refsource_CONFIRM
- https://github.com/eventlet/eventlet/pull/1062 x_refsource_MISC
- https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2025/09/msg00003.html