CVE-2025-58068mediumCWE-444

CVE-2025-58068: falha de média gravidade em eventlet

Eventlet affected by HTTP request smuggling in unparsed trailers

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar eventlet+ Monitorar eventlet

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.4%
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
eventlet · eventlet
CVEs relacionadas — eventlet

No mesmo produto, das mais perigosas para as menos.

CVE-2021-21419MEDIUMImproper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventletEPSS 1.8%