CVE-2025-58068

Name	CVE-2025-58068
Description	Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4289-1
Debian Bugs	1112515

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-eventlet (PTS)	bullseye	0.26.1-7+deb11u1	vulnerable
	bullseye (security)	0.26.1-7+deb11u2	fixed
	bookworm	0.33.1-4	vulnerable
	trixie	0.39.1-2	vulnerable
	forky, sid	0.40.1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-eventlet	source	bullseye	0.26.1-7+deb11u2		DLA-4289-1
python-eventlet	source	(unstable)	0.40.1-3			1112515

Notes

[trixie] - python-eventlet <no-dsa> (Minor issue)
[bookworm] - python-eventlet <no-dsa> (Minor issue)
https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7
https://github.com/eventlet/eventlet/pull/1062
https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb (0.40.3)