CVE-2025-58068

Publication date 29 August 2025

Last updated 25 September 2025

Ubuntu priority

Medium

Why this priority?

Description

Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.

Read the notes from the security team

Status

Package Ubuntu Release Status
python-eventlet 25.04 plucky
Fixed 0.39.0-0ubuntu1.1
24.04 LTS noble
Fixed 0.35.2-0ubuntu1.1
22.04 LTS jammy
Fixed 0.30.2-5ubuntu2.2
20.04 LTS focal
Fixed 0.25.1-2ubuntu1.1+esm2
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Notes

leosilva

for bionic there is a FTBFS that can be fixed by issue #380 though, even after fix it there are SSL testing fails.

References

Related Ubuntu Security Notices (USN)

    • USN-7772-1
    • Eventlet vulnerability
    • 24 September 2025

Other references