PT-2025-35318 · Eventlet+4 · Eventlet+4

Sebastianosrt · CVE-2025-58068 · Published 2025-01-01 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Eventlet versions prior to 0.40.3

Description The Eventlet WSGI parser is susceptible to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This issue could allow attackers to bypass front-end security controls, launch targeted attacks against active site users, and poison web caches.

Recommendations Update to Eventlet version 0.40.3 or later. As a workaround, avoid using Eventlet WSGI when facing untrusted clients.

Exploit

Fix

DoS

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2025-14415

CVE-2025-58068

DLA-4289-1

GHSA-HW6F-RJFJ-J7J7

OESA-2025-2232

OPENSUSE-SU-2025:15507-1

PYSEC-2026-1350

RHSA-2026:1959

SUSE-SU-2025:03051-1

SUSE-SU-2025:03202-1

USN-7772-1

Affected Products

Debian

Eventlet

Linuxmint

Red Os

Ubuntu

References · 41

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58068.json · Exploit
• https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb · Patch
• https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-58068 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58068 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:03202-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14415 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58068 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hw6f-rjfj-j7j7 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-58068 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4289-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15507-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-58068 · Vendor Advisory