CVE-2025-58068 Eventlet affected by HTTP request smuggling in unparsed trailers

Medium 6.3 Published 29 Aug 2025 Updated 3 Nov 2025

Attackers can exploit HTTP request smuggling in Eventlet to bypass security controls, attack users, and poison caches.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-58068?

CVE-2025-58068 is a medium-severity vulnerability in eventlet, published on 29 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.

Weakness: CWE-444

Which versions are affected by CVE-2025-58068?

3 open source packages ship an affected version, including eventlet. It affects 1 product.

Package	Affected	Fixed in
`eventlet` PyPI	All versions	`0.40.3`
`eventlet` PyPI	All versions	`0.40.3`
`eventlet` PyPI	All versions	`0.40.3`

Linux distribution packages (8)

`python-eventlet` Red Hat:openstack:18.0::el9	All versions	`0:0.33.1-7.el9ost`
`python3-eventlet` Red Hat:openstack:18.0::el9	All versions	`0:0.33.1-7.el9ost`
`python-eventlet` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`0.26.1-150300.3.3.1`
`python-eventlet` SUSE:Linux Enterprise Module for Package Hub 15 SP7	All versions	`0.26.1-150300.3.3.1`
`python-eventlet` SUSE:Linux Enterprise Module for Python 3 15 SP6	All versions	`0.33.3-150400.5.6.1`
`python-eventlet` SUSE:Linux Enterprise Module for Python 3 15 SP7	All versions	`0.33.3-150400.5.6.1`
`python-eventlet` openSUSE:Leap 15.6	All versions	`0.33.3-150400.5.6.1`
`python-eventlet` openSUSE:Tumbleweed	All versions	`0.40.3-1.1`

Products include Eventlet Eventlet.

How do I fix CVE-2025-58068?

Upgrade eventlet to 0.40.3 or later.

Is CVE-2025-58068 being exploited?

There is no known exploitation of CVE-2025-58068 in the wild and no public exploit code.

CVE-2021-21419 Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet Medium 5.3

Sources

Also known as DEBIAN-CVE-2025-58068, DLA-4289-1, ECHO-0062-6c67-8811, GHSA-hw6f-rjfj-j7j7, OESA-2025-2199, OESA-2025-2200 and 12 more.