[SECURITY] [DLA 4289-1] python-eventlet security update

🗓️ 02 Sep 2025 14:38:32Reported by DebianType

Eventlet WSGI parser vulnerability enables HTTP request smuggling via trailer handling; fixed in 0.26.1-7+deb11u2.

Reporter	Title	Published	Views	Family All 62
ibm	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to CVEs.	7 Oct 202507:42	–	ibm
ibm	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	19 Dec 202520:44	–	ibm
ibm	Security Bulletin: Eventlet Pre-0.40.3 HTTP Trailer Parsing Flaw Enables HTTP Request Smuggling	19 Nov 202513:56	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite uses eventlet-0.40.1-py3-none-any.whl, commons-lang3-3.17.0.jar, net/http/internal 1.23.4 which is vulnerable to CVE-2025-58068, CVE-2025-48924, CVE-2025-22871	7 Nov 202509:42	–	ibm
bdu_fstec	The vulnerability of the eventlet.wsgi module from the Eventlet library allows a hacker to bypass existing security restrictions.	18 Nov 202500:00	–	bdu_fstec
circl	CVE-2025-58068	30 Aug 202501:10	–	circl
cnnvd	Eventlet 环境问题漏洞	29 Aug 202500:00	–	cnnvd
cve	CVE-2025-58068	29 Aug 202521:12	–	cve
cvelist	CVE-2025-58068 Eventlet affected by HTTP request smuggling in unparsed trailers	29 Aug 202521:12	–	cvelist
debiancve	CVE-2025-58068	29 Aug 202521:12	–	debiancve

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	11	any	python-eventlet	0.26.1-7+deb11u2	python-eventlet_0.26.1-7+deb11u2_any.deb
Debian	11	any	python-eventlet-doc	0.26.1-7+deb11u2	python-eventlet-doc_0.26.1-7+deb11u2_any.deb
Debian	11	any	python3-eventlet	0.26.1-7+deb11u2	python3-eventlet_0.26.1-7+deb11u2_any.deb

02 Sep 2025 14:38Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1

CVSS 46.3

EPSS0.00363

SSVC