GHSA-HW6F-RJFJ-J7J7 Eventlet affected by HTTP request smuggling in unparsed trailers

🗓️ 29 Aug 2025 20:08:24Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

Eventlet WSGI parser is vulnerable to HTTP request smuggling via unparsed trailers; patched in 0.40.3.

Reporter	Title	Published	Views	Family All 59
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to CVEs.	7 Oct 202507:42	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	19 Dec 202520:44	–	ibm
IBM Security Bulletins	Security Bulletin: Eventlet Pre-0.40.3 HTTP Trailer Parsing Flaw Enables HTTP Request Smuggling	19 Nov 202513:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses eventlet-0.40.1-py3-none-any.whl, commons-lang3-3.17.0.jar, net/http/internal 1.23.4 which is vulnerable to CVE-2025-58068, CVE-2025-48924, CVE-2025-22871	7 Nov 202509:42	–	ibm
Circl	CVE-2025-58068	30 Aug 202501:10	–	circl
CNNVD	Eventlet 环境问题漏洞	29 Aug 202500:00	–	cnnvd
CVE	CVE-2025-58068	29 Aug 202521:12	–	cve
Cvelist	CVE-2025-58068 Eventlet affected by HTTP request smuggling in unparsed trailers	29 Aug 202521:12	–	cvelist
Debian	[SECURITY] [DLA 4289-1] python-eventlet security update	2 Sep 202514:38	–	debian
Debian CVE	CVE-2025-58068	29 Aug 202521:12	–	debiancve

Source	Link
github	www.github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-58068
github	www.github.com/eventlet/eventlet/pull/1062
github	www.github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb
github	www.github.com/eventlet/eventlet
lists	www.lists.debian.org/debian-lts-announce/2025/09/msg00003.html

04 Nov 2025 16:41Current

6.8Medium risk

Vulners AI Score6.8

CVSS 46.3

EPSS0.00106

Eventlet Hypertext Transfer Protocol request smuggling unparsed trailers version 0.40.3 Web Server Interface