Skip to main content

Eventlet CVE-2025-58068

MEDIUM
HTTP Request/Response Smuggling (CWE-444)
2025-08-29 security-advisories@github.com
Authentication Bypass Python Request Smuggling Eventlet
Medium
Disputed · 6.3 Vendor: github
View

Vulnerability Assessment

Weakness
CWE
CWE-444
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service HTTP request consistency
Impact

CVSS score of 6.3 (MEDIUM). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. EPSS exploitation probability: 0.06%.
Exploit ScenarioDerived

A remote attacker could manipulate HTTP request interpretation between frontend and backend servers by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

Eventlet is a concurrent networking library for Python. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Enforce strict HTTP parsing, normalize requests at proxy layer, use HTTP/2 end-to-end, reject ambiguous headers.

Affected Packages

pypi eventlet fix: 0.40.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified as HTTP Request/Response Smuggling (CWE-444), which allows attackers to manipulate HTTP request interpretation between frontend and backend servers. Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients. Affected products include: Eventlet. Version information: version 0.40.3.

Know when Eventlet gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (github) PRIMARY 6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SUSE 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat 6.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
Low
Subsequent system: Integrity
Low
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Mar 28, 2026 - 19:09 nvd
Patch available
CVE Published
Aug 29, 2025 - 22:15 nvd
MEDIUM 6.3

DescriptionCVE.org

Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.

Executive ViewAI

Why It Matters

Organizations using Eventlet should be aware of moderate risk from CVE-2025-58068 rated CVSS 6.3. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Low

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

HTTP Request Smuggling HIGH

HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.

Affected Products (CPE)CVE.org

cpe:2.3:a:eventlet:eventlet:*:*:*:*:*:*:*:*

More in Eventlet

View all
CVE-2021-21419 MEDIUM
5.3 May 07

Eventlet is a concurrent networking library for Python. Rated medium severity (CVSS 5.3), this vulnerability is remotely

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-88773 CRITICAL POC
9.3
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2021-23336 MEDIUM POC
5.9
CVE-2025-55315 CRITICAL POC
9.9
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Python 3 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
openSUSE Leap 15.6 Fixed

References

Advisories & patches
PATCH https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb ADVISORY https://access.redhat.com/errata/RHSA-2026:0663 ADVISORY https://access.redhat.com/errata/RHSA-2026:1062 ADVISORY https://access.redhat.com/errata/RHSA-2026:1549 ADVISORY https://access.redhat.com/errata/RHSA-2026:1552 ADVISORY https://access.redhat.com/errata/RHSA-2026:1577 ADVISORY https://access.redhat.com/errata/RHSA-2026:1959 ADVISORY https://access.redhat.com/errata/RHSA-2026:2129 ADVISORY https://access.redhat.com/errata/RHSA-2026:2661 ADVISORY https://access.redhat.com/errata/RHSA-2026:2990 ADVISORY https://access.redhat.com/errata/RHSA-2026:3422 ADVISORY https://access.redhat.com/errata/RHSA-2026:3870 ADVISORY https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7 ADVISORY https://vuldb.com/vuln/321984 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03051/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03202/ REF https://github.com/eventlet/eventlet/pull/1062 REF https://lists.debian.org/debian-lts-announce/2025/09/msg00003.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy