PYSEC-2026-1350 Eventlet affected by HTTP request smuggling in unparsed trailers

🗓️ 07 Jul 2026 16:03:02Reported by GoogleType

osv

osv🔗 osv.dev👁 8 Views

Eventlet WSGI parser vulnerable to HTTP request smuggling via trailers; patch 0.40.3 drops trailers.

Reporter	Title	Published	Views	Family All 62
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to CVEs.	7 Oct 202507:42	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	19 Dec 202520:44	–	ibm
IBM Security Bulletins	Security Bulletin: Eventlet Pre-0.40.3 HTTP Trailer Parsing Flaw Enables HTTP Request Smuggling	19 Nov 202513:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses eventlet-0.40.1-py3-none-any.whl, commons-lang3-3.17.0.jar, net/http/internal 1.23.4 which is vulnerable to CVE-2025-58068, CVE-2025-48924, CVE-2025-22871	7 Nov 202509:42	–	ibm
BDU FSTEC	The vulnerability of the eventlet.wsgi module from the Eventlet library allows a hacker to bypass existing security restrictions.	18 Nov 202500:00	–	bdu_fstec
Circl	CVE-2025-58068	30 Aug 202501:10	–	circl
CNNVD	Eventlet 环境问题漏洞	29 Aug 202500:00	–	cnnvd
CVE	CVE-2025-58068	29 Aug 202521:12	–	cve
Cvelist	CVE-2025-58068 Eventlet affected by HTTP request smuggling in unparsed trailers	29 Aug 202521:12	–	cvelist
Debian	[SECURITY] [DLA 4289-1] python-eventlet security update	2 Sep 202514:38	–	debian

Source	Link
github	www.github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-58068
github	www.github.com/eventlet/eventlet/pull/1062
github	www.github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb
github	www.github.com/eventlet/eventlet
lists	www.lists.debian.org/debian-lts-announce/2025/09/msg00003.html
pypi	www.pypi.org/project/eventlet
github	www.github.com/advisories/GHSA-hw6f-rjfj-j7j7

07 Jul 2026 17:46Current

6.6Medium risk

Vulners AI Score6.6

CVSS 46.3

EPSS0.0036

Eventlet Http request smuggling WSGI parser trailers patch 0.40.3 untrusted clients