Inconsistent interpretation of HTTP requests in eventlet - CVE-2025-58068

Vulnerability identifier: #VU115001

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2025-58068

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests within the WSGI parser. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

eventlet
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Red Hat Enterprise Linux for x86_64
Python 3 Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
Anolis OS
PowerVC
IBM Maximo Application Suite
Red Hat OpenShift Container Platform
python-eventlet (Ubuntu package)
python2-eventlet
python3-eventlet
python-eventlet
python-eventlet-help
python-eventlet (Red Hat package)
python3-eventlet-doc
python311-eventlet
Maximo Application Suite - IoT Component

Install updates from vendor's website.

eventlet - update to 0.40.3
Red Hat OpenShift Container Platform - update to 4.20.11
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
python-eventlet (Ubuntu package) - addressed in versions 0.25.1-2ubuntu1.1+esm2, 0.30.2-5ubuntu2.2, 0.35.2-0ubuntu1.1, 0.39.0-0ubuntu1.1
python2-eventlet - update to 0.26.1-150300.3.3.1
python3-eventlet - update to 0.26.1-150300.3.3.1
python-eventlet - addressed in versions 0.30.2-3, 0.33.0-3, 0.33.3-3
python-eventlet-help - addressed in versions 0.30.2-3, 0.33.0-3, 0.33.3-3
python3-eventlet - addressed in versions 0.30.2-3, 0.33.0-3, 0.33.3-3
python-eventlet (Red Hat package) - update to 0.33.1-7.el9ost
python3-eventlet-doc - update to 0.33.3-3
python3-eventlet - update to 0.33.3-3
python311-eventlet - update to 0.33.3-150400.5.6.1
Maximo Application Suite - IoT Component - addressed in versions 8.7.26, 8.8.22, 9.0.12, 9.1.3

• https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb
• https://github.com/eventlet/eventlet/pull/1062
• https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7

• HTTP request smuggling in Eventlet
• openEuler 22.03 LTS SP4 update for python-eventlet
• openEuler 22.03 LTS SP3 update for python-eventlet
• openEuler 20.03 LTS SP4 update for python-eventlet
• openEuler 24.03 LTS SP2 update for python-eventlet
• openEuler 24.03 LTS SP1 update for python-eventlet
• SUSE update for python-eventlet
• openEuler 24.03 LTS update for python-eventlet
• SUSE update for python-eventlet
• Ubuntu update for python-eventlet
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Maximo Application Suite
• Anolis OS update for python-eventlet
• IBM PowerVC update for Eventlet
• Red Hat OpenStackServices on OpenShift 18 update for python-eventlet
• Multiple vulnerabilities in OpenShift Container Platform 4.20