GitHub Advisoryadvisory · PyPI

GHSA-hw6f-rjfj-j7j7 Eventlet affected by HTTP request smuggling in unparsed trailers

MEDIUM Published 2025-08-29 Modified 2025-11-04 Official page ↗
Aliases
CVE-2025-58068
Ecosystem
PyPI
Packages
eventlet
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-444
Reviewed
2025-08-29

Affected packages

• PyPI eventlet: < 0.40.3 → fixed in 0.40.3

Description

Impact The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to: • Bypass front-end security controls • Launch targeted attacks against active site users • Poison web caches Patches Problem has been patched in eventlet 0.40.3. The patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup. Workarounds Do not use eventlet.wsgi facing untrusted clients. References • Patch https://github.com/eventlet/eventlet/pull/1062 • This issue is similar to https://github.com/advisories/GHSA-9548-qrrj-x5pj

Related

Alias · CVE (1)

  • CVE-2025-58068 Eventlet is a concurrent networking library for Python. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References