Eventlet affected by HTTP request smuggling in unparsed trailers

NGHIÊM TRỌNG 9.1CVE-2025-58068 · GHSA-hw6f-rjfj-j7j7 · PYSEC-2026-1350 · Công bố 29/08/2025 · cập nhật 19/10/2026

Tóm tắt nhanh

CVE-2025-58068 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.1) ảnh hưởng eventlet, eventlet (eventlet).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.42%, cao hơn 36.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.40.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
eventlet PyPI	`< 0.40.3`	`0.40.3`
eventlet eventlet	`< 0.40.3`	`0.40.3`

Mô tả

Impact

The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.

This vulnerability could enable attackers to:

Bypass front-end security controls
Launch targeted attacks against active site users
Poison web caches

Patches

Problem has been patched in eventlet 0.40.3.

The patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup.

Workarounds

Do not use eventlet.wsgi facing untrusted clients.

References

Patch https://github.com/eventlet/eventlet/pull/1062
This issue is similar to https://github.com/advisories/GHSA-9548-qrrj-x5pj

Mô tả của NVD

Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.