Home > Vulnerability Database > CVE-2025-58068

Mend.io Vulnerability Database

CVE-2025-58068

Good to know:

Date: August 29, 2025

Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.

Severity Score

0.0

Related Resources (7)

Url: https://security-tracker.debian.org/tracker/CVE-2025-58068

Url: https://github.com/eventlet/eventlet/pull/1062

Url: https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb

Url: https://github.com/eventlet/eventlet

Url: https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-58068

Url: https://www.mend.io/vulnerability-database/CVE-2025-58068

Weakness Type (CWE)

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE-444

Top Fix

Upgrade Version

Upgrade to version eventlet - 0.40.3

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE