Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:03051-1 advisory.

    - CVE-2025-58068: improper handling of HTTP trailer sections in WSGI parser leads to HTTP request     smuggling       (bsc#1248994).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has a package installed that is affected by a vulnerability as referenced in the USN-7772-1 advisory.

    It was discovered that Eventlet incorrectly handled certain requests. An attacker could possibly use this     issue to bypass front-end security controls, launch targeted attacks against active site users, and poison     web caches.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:03202-1 advisory.

    - CVE-2025-58068: improper handling of HTTP trailer sections in WSGI parser leads to HTTP request     smuggling       (bsc#1248994).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser     is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This     vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks     against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by     dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A     workaround involves not using eventlet.wsgi facing untrusted clients. (CVE-2025-58068)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4289 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4289-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Thomas Goirand     September 02, 2025                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-eventlet     Version        : 0.26.1-7+deb11u2     CVE ID         : CVE-2025-58068     Debian Bug     :

    CVE-2025-58068         Eventlet is a concurrent networking library for Python. Eventlet WSGI         parser is vulnerable to HTTP Request Smuggling due to improper         handling of HTTP trailer sections. This vulnerability could enable         attackers to, bypass front-end security controls, launch targeted         attacks against active site users, and poison web caches.

    For Debian 11 bullseye, this problem has been fixed in version     0.26.1-7+deb11u2.

    We recommend that you upgrade your python-eventlet packages.

    For the detailed security status of python-eventlet please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-eventlet

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
278718	SUSE SLES15 Security Update : python-eventlet (SUSE-SU-2025:03051-1)	Nessus	SuSE Local Security Checks	medium
265929	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : Eventlet vulnerability (USN-7772-1)	Nessus	Ubuntu Local Security Checks	medium
264662	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-eventlet (SUSE-SU-2025:03202-1)	Nessus	SuSE Local Security Checks	medium
260936	Linux Distros Unpatched Vulnerability : CVE-2025-58068	Nessus	Misc.	medium
260699	Debian dla-4289 : python-eventlet-doc - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2025-58068

medium

Tenable Plugins

medium

medium

medium

medium

medium