CVE-2025-58068
Eventlet affected by HTTP request smuggling in unparsed trailers
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Eventlet affected by HTTP request smuggling in unparsed trailers
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
- Record
CVE-2025-58068- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-444
- Updated
- 2026-11-02
EUVDEUVD-2025-26392
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
- Record
EUVD-2025-26392- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hw6f-rjfj-j7j7
Eventlet affected by HTTP request smuggling in unparsed trailers
Impact
The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.
This vulnerability could enable attackers to:
- Bypass front-end security controls
- Launch targeted attacks against active site users
- Poison web caches
Patches
Problem has been patched in eventlet 0.40.3.
The patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup.
Workarounds
Do not use eventlet.wsgi facing untrusted clients.
References
- Patch https://github.com/eventlet/eventlet/pull/1062
- This issue is similar to https://github.com/advisories/GHSA-9548-qrrj-x5pj
- Record
GHSA-hw6f-rjfj-j7j7- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-444
- Updated
- 2026-11-02
NVD
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
- Record
CVE-2025-58068- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSV
Eventlet affected by HTTP request smuggling in unparsed trailers
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
- Record
CVE-2025-58068- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-58068
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
- Record
DEBIAN-CVE-2025-58068- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 15 moreShow less
OSVGHSA-hw6f-rjfj-j7j7
Eventlet affected by HTTP request smuggling in unparsed trailers
Impact
The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.
This vulnerability could enable attackers to:
- Bypass front-end security controls
- Launch targeted attacks against active site users
- Poison web caches
Patches
Problem has been patched in eventlet 0.40.3.
The patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup.
Workarounds
Do not use eventlet.wsgi facing untrusted clients.
References
- Patch https://github.com/eventlet/eventlet/pull/1062
- This issue is similar to https://github.com/advisories/GHSA-9548-qrrj-x5pj
- Record
GHSA-hw6f-rjfj-j7j7- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVOESA-2025-2199
python-eventlet security update
Eventlet is a concurrent networking library for Python that allows you to change how you run your code, not how you write it.
Security Fix(es):
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.(CVE-2025-58068)
- Record
OESA-2025-2199- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-2200
python-eventlet security update
Eventlet is a concurrent networking library for Python that allows you to change how you run your code, not how you write it.
Security Fix(es):
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.(CVE-2025-58068)
- Record
OESA-2025-2200- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-2201
python-eventlet security update
Eventlet is a concurrent networking library for Python that allows you to change how you run your code, not how you write it.
Security Fix(es):
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.(CVE-2025-58068)
- Record
OESA-2025-2201- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-2202
python-eventlet security update
Eventlet is a concurrent networking library for Python that allows you to change how you run your code, not how you write it.
Security Fix(es):
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.(CVE-2025-58068)
- Record
OESA-2025-2202- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-2203
python-eventlet security update
Eventlet is a concurrent networking library for Python that allows you to change how you run your code, not how you write it.
Security Fix(es):
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.(CVE-2025-58068)
- Record
OESA-2025-2203- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2025-2232
python-eventlet security update
Eventlet is a concurrent networking library for Python that allows you to change how you run your code, not how you write it.
Security Fix(es):
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.(CVE-2025-58068)
- Record
OESA-2025-2232- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVPYSEC-2026-1350
Eventlet affected by HTTP request smuggling in unparsed trailers
Impact
The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.
This vulnerability could enable attackers to:
- Bypass front-end security controls
- Launch targeted attacks against active site users
- Poison web caches
Patches
Problem has been patched in eventlet 0.40.3.
The patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup.
Workarounds
Do not use eventlet.wsgi facing untrusted clients.
References
- Patch https://github.com/eventlet/eventlet/pull/1062
- This issue is similar to https://github.com/advisories/GHSA-9548-qrrj-x5pj
- Record
PYSEC-2026-1350- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
OSVRHSA-2026:1959
Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (python-eventlet) security update
- Record
RHSA-2026:1959- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2025-58068
CVE-2025-58068 in rootio-eventlet - Patched by Root
Root has patched CVE-2025-58068 in the rootio-eventlet package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2025-58068- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-58068
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
- Record
UBUNTU-CVE-2025-58068- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15507-1 No score
python311-eventlet-0.40.3-1.1 on GA media
These are all security issues fixed in the python311-eventlet-0.40.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15507-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03051-1 No score
Security update for python-eventlet
This update for python-eventlet fixes the following issues:
- CVE-2025-58068: improper handling of HTTP trailer sections in WSGI parser leads to HTTP request smuggling (bsc#1248994).
- Record
SUSE-SU-2025:03051-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03202-1 No score
Security update for python-eventlet
This update for python-eventlet fixes the following issues:
- CVE-2025-58068: improper handling of HTTP trailer sections in WSGI parser leads to HTTP request smuggling (bsc#1248994).
- Record
SUSE-SU-2025:03202-1- Updated
- 2026-11-02
OSVUSN-7772-1 No score
python-eventlet vulnerability
It was discovered that Eventlet incorrectly handled certain requests. An attacker could possibly use this issue to bypass front-end security controls, launch targeted attacks against active site users, and poison web caches.
- Record
USN-7772-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
eventletPyPI |
before 0.40.3 | 0.40.3 |
python-eventletDebian:12 |
All versions, plus listed versions 0.33.1-40.33.3-10.33.3-20.33.3-2.10.33.3-3 Show 30 moreShow less0.35.1-10.35.1-20.35.1-30.36.1-10.36.1-100.36.1-110.36.1-120.36.1-20.36.1-30.36.1-40.36.1-50.36.1-60.36.1-70.36.1-80.36.1-90.39.1-10.39.1-20.40.1-10.40.1-20.40.1-30.40.2-10.40.3-10.40.3-20.40.4-10.40.4-20.40.4-30.40.4-40.41.2-10.41.2-20.41.2-3 |
None known |
python-eventletDebian:13 |
before 0.39.1-2+deb13u1, plus listed versions 0.39.1-2 |
0.39.1-2+deb13u1 |
python-eventletDebian:14 |
before 0.40.1-3, plus listed versions 0.39.1-20.40.1-10.40.1-2 |
0.40.1-3 |
python-eventletDebian:11 |
before 0.26.1-7+deb11u2, plus listed versions 0.26.1-70.26.1-7+deb11u1 |
0.26.1-7+deb11u2 |
eventletPyPI |
before 0.40.3, plus listed versions 0.10.00.11.00.12.10.13.00.14.0 Show 45 moreShow less0.15.20.16.10.17.40.18.20.18.30.18.40.19.00.20.20.00.20.10.21.00.22.00.22.10.23.00.24.00.24.10.25.00.25.10.25.20.26.00.26.10.27.00.28.00.28.10.29.00.29.10.30.00.30.10.30.20.30.30.31.00.31.10.32.00.33.00.33.10.33.20.33.30.34.10.34.20.34.30.35.00.35.10.35.20.36.00.36.1 |
0.40.3 |
python-eventletopenEuler:24.03-LTS-SP1 |
before 0.33.3-3.oe2403sp1 | 0.33.3-3.oe2403sp1 |
python-eventletopenEuler:24.03-LTS-SP2 |
before 0.33.3-3.oe2403sp2 | 0.33.3-3.oe2403sp2 |
python-eventletopenEuler:20.03-LTS-SP4 |
before 0.30.2-3.oe2003sp4 | 0.30.2-3.oe2003sp4 |
python-eventletopenEuler:22.03-LTS-SP3 |
before 0.33.0-3.oe2203sp3 | 0.33.0-3.oe2203sp3 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-eventletopenEuler:22.03-LTS-SP4 |
before 0.33.0-3.oe2203sp4 | 0.33.0-3.oe2203sp4 |
python-eventletopenEuler:24.03-LTS |
before 0.33.3-3.oe2403 | 0.33.3-3.oe2403 |
python-eventletRed Hat:openstack:18.0::el9 |
before 0:0.33.1-7.el9ost | 0:0.33.1-7.el9ost |
python3-eventletRed Hat:openstack:18.0::el9 |
before 0:0.33.1-7.el9ost | 0:0.33.1-7.el9ost |
rootio-eventletRoot:PyPI |
before 0.33.1+root.io.1 | 0.33.1+root.io.10.33.1+root.io.2 |
eventletRoot:PyPI |
before 0.33.1+aikido.2 | 0.33.1+aikido.2 |
python-eventletSUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 0.26.1-150300.3.3.1 | 0.26.1-150300.3.3.1 |
python-eventletSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 0.26.1-150300.3.3.1 | 0.26.1-150300.3.3.1 |
python-eventletSUSE:Linux Enterprise Module for Python 3 15 SP6 |
before 0.33.3-150400.5.6.1 | 0.33.3-150400.5.6.1 |
python-eventletSUSE:Linux Enterprise Module for Python 3 15 SP7 |
before 0.33.3-150400.5.6.1 | 0.33.3-150400.5.6.1 |
python-eventletopenSUSE:Leap 15.6 |
before 0.33.3-150400.5.6.1 | 0.33.3-150400.5.6.1 |
python-eventletUbuntu:16.04:LTS |
All versions, plus listed versions 0.17.4-2ubuntu10.18.4-1ubuntu10.18.4-1ubuntu2 |
None known |
python-eventletUbuntu:18.04:LTS |
All versions, plus listed versions 0.19.0-70.20.0-2~build10.20.0-2ubuntu10.20.0-2ubuntu20.20.0-30.20.0-4 |
None known |
python-eventletUbuntu:Pro:20.04:LTS |
before 0.25.1-2ubuntu1.1+esm2, plus listed versions 0.25.0-0ubuntu10.25.1-2build10.25.1-2ubuntu10.25.1-2ubuntu1.1 |
0.25.1-2ubuntu1.1+esm2 |
python-eventletUbuntu:22.04:LTS |
before 0.30.2-5ubuntu2.2, plus listed versions 0.30.2-0ubuntu10.30.2-0ubuntu20.30.2-5ubuntu2 |
0.30.2-5ubuntu2.2 |
python-eventletUbuntu:24.04:LTS |
before 0.35.2-0ubuntu1.1, plus listed versions 0.33.1-4ubuntu10.33.1-4ubuntu20.35.1-0ubuntu10.35.1-0ubuntu20.35.2-0ubuntu1 |
0.35.2-0ubuntu1.1 |
python-eventletUbuntu:25.10 |
before 0.39.0-0ubuntu2, plus listed versions 0.39.0-0ubuntu1 |
0.39.0-0ubuntu2 |
python-eventletUbuntu:26.04:LTS |
before 0.39.0-0ubuntu2 | 0.39.0-0ubuntu2 |
python-eventletopenSUSE:Tumbleweed |
before 0.40.3-1.1 | 0.40.3-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-58068 is a medium vulnerability (CVSS 6.3) in Eventlet, published August 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in eventlet 0.40.3.
References
github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7
lists.debian.org/debian-lts-announce/2025/09/msg00003.html
nvd.nist.gov/vuln/detail/CVE-2025-58068
Show 24 moreShow less
security-tracker.debian.org/tracker/CVE-2025-58068
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2199
pypi.org/project/eventlet
access.redhat.com/errata/RHSA-2026:1959
bugzilla.redhat.com/show_bug.cgi?id=2391958
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1959.json
cve.org/CVERecord?id=CVE-2025-58068
suse.com/support/update/announcement/2025/suse-su-202503051-1
bugzilla.suse.com/1248994
ubuntu.com/security/CVE-2025-58068
launchpad.net/bugs/2125423
Left out here: 15 versions. The JSON record has them.