PT-2025-35318 · Eventlet +1 · Eventlet +1

Sebastianosrt · Published 2025-01-01 · Updated 2025-08-30 · CVE-2025-58068

Positive Technologies · (AI Summary)

CVSS v4.0

6.3

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions:

Eventlet versions prior to 0.40.3

Description:

The Eventlet WSGI parser is susceptible to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This issue could allow attackers to bypass front-end security controls, launch targeted attacks against active site users, and poison web caches.

Recommendations:

Update to Eventlet version 0.40.3 or later.

As a workaround, avoid using Eventlet WSGI when facing untrusted clients.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2025-58068

GHSA-HW6F-RJFJ-J7J7

Affected Products

Debian

Eventlet

References · 14

• https://osv.dev/vulnerability/GHSA-hw6f-rjfj-j7j7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58068 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58068 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-58068 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/python-eventlet · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58068 · Security Note
• https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb · Note
• https://github.com/eventlet/eventlet/pull/1062 · Note
• https://github.com/eventlet/eventlet · Note
• https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7 · Note
• https://t.me/CVEtracker/31294 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1961630750756753658 · Twitter Post
• https://twitter.com/CVEnew/status/1961541535146881355 · Twitter Post
• https://packages.debian.org/src:python-eventlet · Note