GHSA-hw6f-rjfj-j7j7

Suggest an improvement
Source
https://github.com/advisories/GHSA-hw6f-rjfj-j7j7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-hw6f-rjfj-j7j7/GHSA-hw6f-rjfj-j7j7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hw6f-rjfj-j7j7
Aliases
Downstream
Published
2025-08-29T20:08:24Z
Modified
2026-07-07T17:56:50Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Eventlet affected by HTTP request smuggling in unparsed trailers
Details

Impact

The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.

This vulnerability could enable attackers to:

  • Bypass front-end security controls
  • Launch targeted attacks against active site users
  • Poison web caches

Patches

Problem has been patched in eventlet 0.40.3.

The patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup.

Workarounds

Do not use eventlet.wsgi facing untrusted clients.

References

Database specific 
{
    "cwe_ids":  [
        "CWE-444"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-08-29T20:08:24Z",
    "nvd_published_at":  "2025-08-29T22:15:32Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / eventlet

Package

Name
eventlet
View open source insights on deps.dev
Purl
pkg:pypi/eventlet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.40.3

Affected versions

0.*
0.2
0.5.3
0.6.1
0.7
0.8
0.8.16
0.9.17
0.10.0
0.11.0
0.12.1
0.13.0
0.14.0
0.15.2
0.16.1
0.17.4
0.18.2
0.18.3
0.18.4
0.19.0
0.20.0
0.20.1
0.21.0
0.22.0
0.22.1
0.23.0
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.27.0
0.28.0
0.28.1
0.29.0
0.29.1
0.30.0
0.30.1
0.30.2
0.30.3
0.31.0
0.31.1
0.32.0
0.33.0
0.33.1
0.33.2
0.33.3
0.34.1
0.34.2
0.34.3
0.35.0
0.35.1
0.35.2
0.36.0
0.36.1
0.37.0
0.38.0
0.38.1
0.38.2
0.39.0
0.39.1
0.40.0
0.40.1
0.40.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-hw6f-rjfj-j7j7/GHSA-hw6f-rjfj-j7j7.json"