pypi package report

Is eventlet safe?

3 known vulnerabilities, worst severity MODERATE.

// reach

9 direct dependencies

2 carry known advisories, worst HIGH

21 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

No published models are known to use this package.

cvss

6.3

medium

CVSS v4.0 base score out of 10

epss

0.42%

medium

chance of exploitation in 30 days, 36th percentile of all CVEs

xyz score

not scored

CyberXYZ composite out of 10

fig. 01 — GHSA-hw6f-rjfj-j7j7, the advisory selected below

// 3 advisories

GHSA-hw6f-rjfj-j7j7

MODERATEGitHub ratingCVE-2025-58068

// impact

The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.

This vulnerability could enable attackers to:

Bypass front-end security controls
Launch targeted attacks against active site users
Poison web caches

// patches

Problem has been patched in eventlet 0.40.3.

The patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup.

// workarounds

Do not use eventlet.wsgi facing untrusted clients.

// references

Patch https://github.com/eventlet/eventlet/pull/1062
This issue is similar to https://github.com/advisories/GHSA-9548-qrrj-x5pj

// cvss v4.0 vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): Low
Integrity (subsequent systems): Low
Availability (subsequent systems): None

Checked 2026-11-06 at 22:26 UTC. The most recent advisory here was published 2025-08-29. Updated continuously from NVD, GHSA, OSV and CNA feeds.