Vulnerability-Lookup

CVE-2025-58068 (GCVE-0-2025-58068)

Vulnerability from cvelistv5 – Published: 2025-08-29 21:12 – Updated: 2025-11-03 18:13

Title

Eventlet affected by HTTP request smuggling in unparsed trailers

Summary

Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-02 13:49 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7639 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/eventlet/eventlet/security/adv…	x_refsource_CONFIRM
https://github.com/eventlet/eventlet/pull/1062	x_refsource_MISC
https://github.com/eventlet/eventlet/commit/0bfeb…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version	CPE status
eventlet	eventlet	Affected: < 0.40.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-58068",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-02T13:49:48.188360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-02T13:51:35.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:13:48.690Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "eventlet",
          "vendor": "eventlet",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.40.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-29T21:12:24.534Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7"
        },
        {
          "name": "https://github.com/eventlet/eventlet/pull/1062",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/eventlet/eventlet/pull/1062"
        },
        {
          "name": "https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb"
        }
      ],
      "source": {
        "advisory": "GHSA-hw6f-rjfj-j7j7",
        "discovery": "UNKNOWN"
      },
      "title": "Eventlet affected by HTTP request smuggling in unparsed trailers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-58068",
    "datePublished": "2025-08-29T21:12:24.534Z",
    "dateReserved": "2025-08-22T14:30:32.223Z",
    "dateUpdated": "2025-11-03T18:13:48.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-58068",
      "date": "2026-10-20",
      "epss": "0.0039",
      "percentile": "0.31617"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "eventlet",
                "vendor": "eventlet",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.40.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:eventlet:eventlet:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "458E8C32-D5A4-47C6-9A7F-5EE3ECD09738",
                    "versionEndExcluding": "0.40.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients."
          },
          {
            "lang": "es",
            "value": "Eventlet es una biblioteca de red concurrente para Python. Antes de la versi\u00f3n 0.40.3, el analizador WSGI de Eventlet es vulnerable a Contrabando de Solicitudes HTTP debido a un manejo inadecuado de las secciones de tr\u00e1iler HTTP. Esta vulnerabilidad podr\u00eda permitir a los atacantes eludir los controles de seguridad de front-end, lanzar ataques dirigidos contra usuarios activos del sitio y envenenar las cach\u00e9s web. Este problema ha sido parcheado en Eventlet 0.40.3 eliminando los tr\u00e1ilers, lo cual es un cambio disruptivo si un backend detr\u00e1s de un proxy eventlet.wsgi requiere tr\u00e1ilers. Una soluci\u00f3n alternativa implica no usar eventlet.wsgi frente a clientes no confiables."
          }
        ],
        "id": "CVE-2025-58068",
        "lastModified": "2026-10-19T17:10:00.173",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-58068",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-02T13:49:48.188360Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-08-29T22:15:32.327",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://github.com/eventlet/eventlet/pull/1062"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00003.html"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-444"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-08T11:36:53+00:00",
      "cve": "CVE-2025-58068",
      "id": "CVE-2025-58068",
      "initial_release_date": "2025-08-29T21:12:24.534000+00:00",
      "product_status:fixed": "38",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "5642",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "python-eventlet: Eventlet HTTP request smuggling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58068.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-58068",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-09-02T13:49:48.188360Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-09-02T13:50:18.375Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "eventlet",
              "vendor": "eventlet",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.40.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-444",
                  "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-08-29T21:12:24.534Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7"
            },
            {
              "name": "https://github.com/eventlet/eventlet/pull/1062",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/eventlet/eventlet/pull/1062"
            },
            {
              "name": "https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb"
            }
          ],
          "source": {
            "advisory": "GHSA-hw6f-rjfj-j7j7",
            "discovery": "UNKNOWN"
          },
          "title": "Eventlet affected by HTTP request smuggling in unparsed trailers"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-58068",
        "datePublished": "2025-08-29T21:12:24.534Z",
        "dateReserved": "2025-08-22T14:30:32.223Z",
        "dateUpdated": "2025-09-02T13:51:35.797Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

OPENSUSE-SU-2025:15507-1

Vulnerability from csaf_opensuse - Published: 2025-09-01 00:00 - Updated: 2026-09-20 21:40

Summary

python311-eventlet-0.40.3-1.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-58068.

CVE-2025-58068

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Recommended: 12 products

Open the full advisory

PYSEC-2026-1350

Vulnerability from pysec - Published: 2026-07-07 16:03 - Updated: 2026-07-07 17:24

Details

Impact

The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.

This vulnerability could enable attackers to: - Bypass front-end security controls - Launch targeted attacks against active site users - Poison web caches

Patches

Problem has been patched in eventlet 0.40.3.

The patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup.

Workarounds

Do not use eventlet.wsgi facing untrusted clients.

References

Patch https://github.com/eventlet/eventlet/pull/1062
This issue is similar to https://github.com/advisories/GHSA-9548-qrrj-x5pj

Severity

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Impacted products

Name	purl
eventlet	pkg:pypi/eventlet

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "eventlet",
        "purl": "pkg:pypi/eventlet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.40.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.0",
        "0.11.0",
        "0.12.1",
        "0.13.0",
        "0.14.0",
        "0.15.2",
        "0.16.1",
        "0.17.4",
        "0.18.2",
        "0.18.3",
        "0.18.4",
        "0.19.0",
        "0.2",
        "0.20.0",
        "0.20.1",
        "0.21.0",
        "0.22.0",
        "0.22.1",
        "0.23.0",
        "0.24.0",
        "0.24.1",
        "0.25.0",
        "0.25.1",
        "0.25.2",
        "0.26.0",
        "0.26.1",
        "0.27.0",
        "0.28.0",
        "0.28.1",
        "0.29.0",
        "0.29.1",
        "0.30.0",
        "0.30.1",
        "0.30.2",
        "0.30.3",
        "0.31.0",
        "0.31.1",
        "0.32.0",
        "0.33.0",
        "0.33.1",
        "0.33.2",
        "0.33.3",
        "0.34.1",
        "0.34.2",
        "0.34.3",
        "0.35.0",
        "0.35.1",
        "0.35.2",
        "0.36.0",
        "0.36.1",
        "0.37.0",
        "0.38.0",
        "0.38.1",
        "0.38.2",
        "0.39.0",
        "0.39.1",
        "0.40.0",
        "0.40.1",
        "0.40.2",
        "0.5.3",
        "0.6.1",
        "0.7",
        "0.8",
        "0.8.16",
        "0.9.17"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-58068",
    "GHSA-hw6f-rjfj-j7j7"
  ],
  "details": "### Impact\nThe Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.\n\nThis vulnerability could enable attackers to:\n- Bypass front-end security controls\n- Launch targeted attacks against active site users\n- Poison web caches\n\n### Patches\nProblem has been patched in eventlet 0.40.3.\n\nThe patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup.\n\n### Workarounds\nDo not use eventlet.wsgi facing untrusted clients.\n\n### References\n- Patch https://github.com/eventlet/eventlet/pull/1062\n- This issue is similar to https://github.com/advisories/GHSA-9548-qrrj-x5pj",
  "id": "PYSEC-2026-1350",
  "modified": "2026-07-07T17:24:06.360154Z",
  "published": "2026-07-07T16:03:02.778128Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58068"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eventlet/eventlet/pull/1062"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/eventlet/eventlet"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00003.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/eventlet"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-hw6f-rjfj-j7j7"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Eventlet affected by HTTP request smuggling in unparsed trailers"
}

RHSA-2026:0663

Vulnerability from csaf_redhat - Published: 2026-01-22 03:28 - Updated: 2026-10-20 17:14

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.20.11 bug fix and security update

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2025-58068.

CVE-2025-58068

A request smuggling flaw was found in the Eventlet PyPI library. The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability allows attackers to bypass front-end security controls, launch targeted attacks against active site users, and poison web caches.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 4 products Known not affected: 663 products

https://access.redhat.com/errata/RHSA-2026:0663

Open the full advisory

RHSA-2026:1062

Vulnerability from csaf_redhat - Published: 2026-02-03 17:11 - Updated: 2026-10-15 12:16

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.18.32 bug fix and security update

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2025-58068.

CVE-2025-58068

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 4 products Known not affected: 654 products

https://access.redhat.com/errata/RHSA-2026:1062

Open the full advisory

RHSA-2026:1549

Vulnerability from csaf_redhat - Published: 2026-02-05 15:48 - Updated: 2026-10-15 12:16

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.15.61 bug fix and security update

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2025-58068.

CVE-2025-58068

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 4 products Known not affected: 656 products

https://access.redhat.com/errata/RHSA-2026:1549

Open the full advisory

RHSA-2026:1552

Vulnerability from csaf_redhat - Published: 2026-02-04 10:50 - Updated: 2026-10-20 17:14

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.19.23 bug fix and security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2025-58068.

CVE-2025-58068

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 4 products Known not affected: 654 products

https://access.redhat.com/errata/RHSA-2026:1552

Open the full advisory

RHSA-2026:1577

Vulnerability from csaf_redhat - Published: 2026-02-04 08:15 - Updated: 2026-10-15 12:16

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.17.48 bug fix and security update

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2025-58068.

CVE-2025-58068

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 4 products Known not affected: 654 products

https://access.redhat.com/errata/RHSA-2026:1577

Open the full advisory

RHSA-2026:1959

Vulnerability from csaf_redhat - Published: 2026-02-13 07:33 - Updated: 2026-09-08 11:37

Summary

Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (python-eventlet) security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-58068.

CVE-2025-58068

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 4 products

https://access.redhat.com/errata/RHSA-2026:1959

Open the full advisory

RHSA-2026:2129

Vulnerability from csaf_redhat - Published: 2026-02-10 09:39 - Updated: 2026-10-20 17:14

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.21.1 bug fix and security update

Severity

Important

Scope

6 vulnerabilities in this advisory, including CVE-2025-58068.

CVE-2025-58068

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 2 products Known not affected: 657 products

https://access.redhat.com/errata/RHSA-2026:2129

Open the full advisory

RHSA-2026:2661

Vulnerability from csaf_redhat - Published: 2026-02-18 09:27 - Updated: 2026-10-15 19:24

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.16.57 bug fix and security update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2025-58068.

CVE-2025-58068

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Fixed: 4 products Known not affected: 656 products

https://access.redhat.com/errata/RHSA-2026:2661

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-58068 (GCVE-0-2025-58068)

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour