Skip to content
Fencer Vulns
critical 9.1

CVE-2025-58068 json

Eventlet affected by HTTP request smuggling in unparsed trailers

published 2025-08-29 14 mo ago modified 2026-10-19 20 d ago also EUVD-2025-26392 , GHSA-hw6f-rjfj-j7j7 , PYSEC-2026-1350

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits
0
none known

Summary

Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.

Patch / fix

  • pypi eventlet 0.40.3
  • eventlet eventlet 0.40.3
  • python-eventlet Debian 13 0.39.1-2+deb13u1
  • python-eventlet Debian 14 0.40.1-3

debian advisories DEBIAN-CVE-2025-58068

  • python-eventlet Ubuntu 22.04 LTS 0.30.2-5ubuntu2.2
  • python-eventlet Ubuntu 24.04 LTS 0.35.2-0ubuntu1.1
  • python-eventlet Ubuntu 26.04 LTS, Ubuntu 25.10 0.39.0-0ubuntu2
  • python-eventlet Ubuntu Pro 20.04 LTS 0.25.1-2ubuntu1.1+esm2

ubuntu advisories UBUNTU-CVE-2025-58068

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-eventlet openstack 18.0 0.33.1-7.el9ost
  • python3-eventlet openstack 18.0 0.33.1-7.el9ost

red hat advisories RHSA-2026:1959

  • python-eventlet SLE Module for Python 3 15 SP7, SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 0.33.3-150400.5.6.1
  • python-eventlet SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6 0.26.1-150300.3.3.1

suse advisories SUSE-SU-2025:03202-1SUSE-SU-2025:03051-1

  • python-eventlet openSUSE Tumbleweed 0.40.3-1.1

opensuse advisories openSUSE-SU-2025:15507-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-58068 updated cvss 6.5

python-eventlet: Eventlet HTTP request smuggling

  • Red Hat OpenShift Container Platform 4 python-eventlet, python3-eventlet
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 16.2 python3-eventlet Red Hat OpenStack Platform 17.1 python-eventlet, python3-eventlet
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4.2 openshift4 1768198005, openshift4 1768198161
    fixed: vendor fix RHSA-2026:0663
  • Red Hat OpenShift Container Platform 4.12 openshift4 1772155648, openshift4 1772155649
    fixed: vendor fix RHSA-2026:3870
  • Red Hat OpenShift Container Platform 4.13 openshift4 1771853307, openshift4 1771853308
    fixed: vendor fix RHSA-2026:3422
  • Red Hat OpenShift Container Platform 4.14 openshift4 1770733664, openshift4 1770733671
    fixed: vendor fix RHSA-2026:2990
  • Red Hat OpenShift Container Platform 4.15 openshift4 1769529683, openshift4 1769530180
    fixed: vendor fix RHSA-2026:1549
  • Red Hat OpenShift Container Platform 4.16 openshift4 1770654140, openshift4 1770654676
    fixed: vendor fix RHSA-2026:2661
show 6 more
  • Red Hat OpenShift Container Platform 4.17 openshift4 1769561620, openshift4 1769561753
    fixed: vendor fix RHSA-2026:1577
  • Red Hat OpenShift Container Platform 4.18 openshift4 1768695762, openshift4 1768710367
    fixed: vendor fix RHSA-2026:1062
  • Red Hat OpenShift Container Platform 4.19 openshift4 1769082295, openshift4 1769082432
    fixed: vendor fix RHSA-2026:1552
  • Red Hat OpenShift Container Platform 4.21 openshift4 1769726200
    fixed: vendor fix RHSA-2026:2129
  • Red Hat OpenStack Services on OpenShift 18 python-eventlet 0.33.1-7.el9ost, python3-eventlet 0.33.1-7.el9ost Red Hat OpenStack Services on OpenShift 18.0 python-eventlet 0.33.1-7.el9ost, python3-eventlet 0.33.1-7.el9ost
    fixed: vendor fix RHSA-2026:1959
  • Red Hat OpenShift Container Platform 4.2 openshift4 1768198038, openshift4 1768198040, openshift4 1768198098, openshift4 1768198101, openshift4 1768198105, openshift4 1768198126, +180 more Red Hat OpenShift Container Platform 4.12 openshift4 1772156154, openshift4 1772156192, openshift4 1772156206, openshift4 1772156209, openshift4 1772156210, openshift4 1772156219, +146 more Red Hat OpenShift Container Platform 4.13 openshift4 1770730670, openshift4 1770730945, openshift4 1770731807, openshift4 1770732006, openshift4 1771853317, openshift4 1771853592, +151 more Red Hat OpenShift Container Platform 4.14 openshift4 1770733687, openshift4 1770733763, openshift4 1770733766, openshift4 1770733777, openshift4 1770733836, openshift4 1770733839, +177 more Red Hat OpenShift Container Platform 4.15 openshift4 1769091830, openshift4 1769091936, openshift4 1769091941, openshift4 1769092023, openshift4 1769092024, openshift4 1769092093, +174 more Red Hat OpenShift Container Platform 4.16 openshift4 1770654209, openshift4 1770654875, openshift4 1770659491, openshift4 1770659511, openshift4 1770659551, openshift4 1770659586, +175 more
    +4 more products
    Red Hat OpenShift Container Platform 4.17 openshift4 1769561542, openshift4 1769561550, openshift4 1769561565, openshift4 1769561682, openshift4 1769561702, openshift4 1769561800, +178 more Red Hat OpenShift Container Platform 4.18 openshift4 1768580363, openshift4 1768582209, openshift4 1768582676, openshift4 1768584388, openshift4 1768585045, openshift4 1768585834, +175 more Red Hat OpenShift Container Platform 4.19 openshift4 1768606589, openshift4 1768606595, openshift4 1768606605, openshift4 1768606608, openshift4 1768606615, openshift4 1768606620, +176 more Red Hat OpenShift Container Platform 4.21 openshift4 1769725137, openshift4 1769725144, openshift4 1769725145, openshift4 1769725150, openshift4 1769725153, openshift4 1769725155, +177 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
14 mo ago

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi eventlet
<0.40.3
0.40.3

Affected products

  • eventlet eventlet

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.