Vulnerabilities affecting this package (1)
| Vulnerability |
Summary |
Fixed by |
VCID-bnye-3p23-zyc9
Aliases:
CVE-2025-58068
GHSA-hw6f-rjfj-j7j7
|
Eventlet affected by HTTP request smuggling in unparsed trailers
### Impact
The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.
This vulnerability could enable attackers to:
- Bypass front-end security controls
- Launch targeted attacks against active site users
- Poison web caches
### Patches
Problem has been patched in eventlet 0.40.3.
The patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup.
### Workarounds
Do not use eventlet.wsgi facing untrusted clients.
### References
- Patch https://github.com/eventlet/eventlet/pull/1062
- This issue is similar to https://github.com/advisories/GHSA-9548-qrrj-x5pj
|
There are no reported fixed by versions.
|
Vulnerabilities fixed by this package (0)
| Vulnerability |
Summary |
Aliases |
|
This package is not known to fix vulnerabilities.
|