CVE-2025-58068 is a critical (CVSS 9.1) HTTP request smuggling flaw in Eventlet, the Python networking library. Its WSGI parser handled trailer sections improperly before version 0.40.3. Upgrade to 0.40.3, noting that the fix drops trailers, or avoid exposing eventlet.wsgi to untrusted clients.
What's affected
Eventlet versions before 0.40.3, per the record and the GitHub advisory. The fixed version is 0.40.3.
Applications that serve traffic through eventlet.wsgi are the concern, especially when a proxy or cache sits in front of them.
The patch drops HTTP trailers. The advisory warns this breaks a setup in which a backend behind eventlet.wsgi needs trailers.
How to check if you're exposed
Find Eventlet in every Python environment and image.
pip show eventlet
pip list 2>/dev/null | grep -i eventlet
pip freeze | grep -i eventlet
Then check whether you actually use the WSGI server. Search your code for eventlet.wsgi. Many projects import Eventlet only for green threads or monkey patching and never serve HTTP with it, in which case the exposure is lower. Services that do serve HTTP through it deserve a closer look.
What to do now
- Find every service and image that installs Eventlet.
- Upgrade to 0.40.3 or later and redeploy.
- Test any workflow that depends on HTTP trailers, because the patch removes them.
- Where an upgrade is not possible yet, follow the advisory workaround: do not use eventlet.wsgi facing untrusted clients, and put a hardened server or proxy in front.
Why it matters
Request smuggling arises when two systems in a chain disagree about where one HTTP request ends and the next begins. If a front-end proxy and the Eventlet backend parse trailer sections differently, an attacker can hide a second request inside the first. The advisory lists the consequences as bypassing front-end security controls, targeted attacks on active users and web cache poisoning.
The fix is blunt but safe: trailers are dropped. That is a good tradeoff for most services, and it is the reason to test before rolling out.
The record classifies the weakness as CWE-444 (HTTP Request Smuggling).
Smuggling bugs tend to come in families. The advisory itself points to a similar earlier issue, which is a reminder to keep proxies, load balancers and application servers all on current versions, and to prefer a single well maintained HTTP front end that normalizes requests before they reach application code.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
If you are not sure where a component like this sits in your own stack, the free in-browser dependency scan can list the affected packages in a manifest you paste in. Reachability analysis then helps separate the services that actually call the vulnerable code from the ones that only list it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I only use Eventlet for green threads?
The advisory concerns the WSGI parser. If you never serve HTTP with eventlet.wsgi the direct exposure is small, but upgrading is still cheap.
What breaks after the patch?
Trailers are dropped. A backend that requires HTTP trailers would stop working as before.
Sources
Last reviewed: 18 October 2026.
