by Kastro
Paper/Archive/CVE-2025-58068

CVE-2025-58068

eventlet eventlet — Eventlet affected by HTTP request smuggling in unparsed trailers

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 36.3.363 × 207.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.

Affected

ProductAffectedFixed inSource
eventlet< 0.40.3–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7refgithub.com/eventlet/eventlet/pull/1062refgithub.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fbreflists.debian.org/debian-lts-announce/2025/09/msg00003.html