Eventlet affected by HTTP request smuggling in unparsed trailers
Priority LOW 34CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Partial Red Hat: 12 fixed, 3 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0042 36th percentileScored 2026-11-07
Fix Partial eventlet (eventlet): 0.40.3eventlet (PyPI): 0.40.3Red Hat: 11 advisoriesRed Hat: 12 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| eventlet | eventlet | before 0.40.3 | 0.40.3 | Patch available | CNA |
| — | eventlet (PyPI) | before 0.40.3 | 0.40.3 | Patch available | GHSA-hw6f-rjfj-j7j7 |
- eventlet Vendoreventlet Affected before 0.40.3 Fixed in 0.40.3 Patch available CNA
- eventlet (PyPI) Vendor— Affected before 0.40.3 Fixed in 0.40.3 Patch available GHSA-hw6f-rjfj-j7j7
Remediation
- Fix · CNA eventlet (eventlet) Fixed in 0.40.3
- Fix · GHSA-hw6f-rjfj-j7j7 eventlet (PyPI) Fixed in 0.40.3 Advisory →
Red Hat 11 advisories
- RHSA-2026:3870 Released 2026-03-12 · Red Hat rating ImportantOpenShift Container Platform 4.12.86 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator, registry.redhat.io/openshift4/ose-cluster-etcd-rhel8-operator, registry.redhat.io/openshift4/ose-cluster-kube-storage-version-migrator-rhel8-operator +11
- RHSA-2026:3422 Released 2026-03-05 · Red Hat rating ImportantOpenShift Container Platform 4.13.64 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator, registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8 +13
- RHSA-2026:2990 Released 2026-02-26 · Red Hat rating ImportantOpenShift Container Platform 4.14.62 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator, registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8, registry.redhat.io/openshift4/ose-cluster-etcd-rhel8-operator +12
Show 8 more Red Hat advisories
- RHSA-2026:2661 Released 2026-02-18 · Red Hat rating ImportantOpenShift Container Platform 4.16.57 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-hyperkube-rhel9, registry.redhat.io/openshift4/ose-ironic-agent-rhel9 +2
- RHSA-2026:1959 Released 2026-02-13 · Red Hat rating ModerateRed Hat OpenStack Services on OpenShift 18.0 (python-eventlet) security update
- 9Base-RHOSO-TOOLS-18 python-eventlet-0.33.1-7.el9ost, python3-eventlet-0.33.1-7.el9ost
- Red Hat OpenStack Services on OpenShift 18.0 python-eventlet-0.33.1-7.el9ost, python3-eventlet-0.33.1-7.el9ost
- RHSA-2026:2129 Released 2026-02-10 · Red Hat rating ImportantOpenShift Container Platform 4.21.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-ironic-rhel9 +2
- RHSA-2026:1549 Released 2026-02-05 · Red Hat rating ModerateOpenShift Container Platform 4.15.61 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/ose-alibaba-cloud-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator, registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8 +7
- RHSA-2026:1552 Released 2026-02-04 · Red Hat rating ImportantOpenShift Container Platform 4.19.23 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-baremetal-installer-rhel9, registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9 +3
- RHSA-2026:1577 Released 2026-02-04 · Red Hat rating ModerateOpenShift Container Platform 4.17.48 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ose-baremetal-installer-rhel9, registry.redhat.io/openshift4/ose-ironic-agent-rhel9, registry.redhat.io/openshift4/ose-ironic-rhel9 +1
- RHSA-2026:1062 Released 2026-02-03 · Red Hat rating ModerateOpenShift Container Platform 4.18.32 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-ironic-agent-rhel9, registry.redhat.io/openshift4/ose-ironic-rhel9, registry.redhat.io/openshift4/ose-operator-marketplace-rhel9
- RHSA-2026:0663 Released 2026-01-22 · Red Hat rating ModerateOpenShift Container Platform 4.20.11 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Out of support scope |
| 9Base-RHOSO-TOOLS-18 | Fixed | RHSA-2026:1959 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2026:3870 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2026:3422 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:2990 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:1549 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:2661 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:1577 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:1062 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:1552 |
| Red Hat OpenShift Container Platform 4.2 | Fixed | RHSA-2026:0663 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:2129 |
| Red Hat OpenStack Services on OpenShift 18.0 | Fixed | RHSA-2026:1959 |
Not affected: 10 products
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.2
- Red Hat OpenShift Container Platform 4.21
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58068
- 2026-10-03 Alias added: GHSA-hw6f-rjfj-j7j7
- 2026-10-31 Fix available: RHSA-2026:1552 · Red Hat
References
Advisory 2
More Eventlet vulnerabilities
- TI-2023-13855 eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to… CVSS 3.1HIGH 7.0
- TI-2021-04517 Uncontrolled resource consumption in eventlet CVSS 3.1MEDIUM 5.3
Sources
- CVE-2025-58068 · CVE Program
- CVE-2025-58068 · NVD
- FIRST EPSS
- GHSA-hw6f-rjfj-j7j7 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-58068 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences