Description
Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers to, bypass front-end security controls, launch targeted attacks against active site users, and poison web caches. This problem has been patched in Eventlet 0.40.3 by dropping trailers which is a breaking change if a backend behind eventlet.wsgi proxy requires trailers. A workaround involves not using eventlet.wsgi facing untrusted clients.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| eventlet | eventlet | < 0.40.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-eventlet | 0.40.1-3 | — |
| Debian 13 | python-eventlet | 0.39.1-2+deb13u1 | — |
| Debian 12 | python-eventlet | No fix yet | — |
| Debian 11 | python-eventlet | 0.26.1-7+deb11u2 | DLA-4289-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | python-eventlet | 0.39.0-0ubuntu2 | — |
| Ubuntu 25.10 | python-eventlet | 0.39.0-0ubuntu2 | — |
| Ubuntu 24.04 LTS | python-eventlet | 0.35.2-0ubuntu1.1 | USN-7772-1 |
| Ubuntu 22.04 LTS | python-eventlet | 0.30.2-5ubuntu2.2 | USN-7772-1 |
| Ubuntu 18.04 LTS | python-eventlet | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | python-eventlet | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-eventlet | 0.25.1-2ubuntu1.1+esm2 | USN-7772-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 18 | python-eventlet +1 | 0.33.1-7.el9ost | RHSA-2026:1959 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | python-eventlet | 0.26.1-150300.3.3.1 | SUSE-SU-2025:03051-1 |
| SLES 15 SP6 | python-eventlet | 0.26.1-150300.3.3.1 | SUSE-SU-2025:03051-1 |
| SLES 3 | python-eventlet | 0.33.3-150400.5.6.1 | SUSE-SU-2025:03202-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-eventlet | 0.40.3-1.1 | openSUSE-SU-2025:15507-1 |
| openSUSE Leap 15.6 | python-eventlet | 0.33.3-150400.5.6.1 | SUSE-SU-2025:03202-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | eventlet | < 0.40.3 | 0.40.3 | GHSA-hw6f-rjfj-j7j7 |
Advisories 7
- RHSA-2026:1959 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (python-eventlet) security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- WID-SEC-2026-0408 Red Hat OpenStack Services auf OpenShift (python-eventlet, keystone): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 13, 2026
- USN-7772-1 python-eventlet vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2025:15507-1 python311-eventlet-0.40.3-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03202-1 Security update for python-eventlet SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03051-1 Security update for python-eventlet SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4289-1 python-eventlet - security update Debian Security (DSA / DLA) · Mar 9, 2026