From 4e151d13a160e4d2a98dc77d32e5c3fe2c42f2b9 Mon Sep 17 00:00:00 2001 From: sebsrt Date: Mon, 11 Aug 2025 11:46:28 +0200 Subject: [PATCH] Fix request smuggling vulnerability by discarding trailers (#1062) The WSGI parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. This patch fix that by discarding trailers. CVE: CVE-2025-58068 Upstream-Status: Backport [https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb] Signed-off-by: Gyorgy Sarvari --- eventlet/wsgi.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/eventlet/wsgi.py b/eventlet/wsgi.py index 7ef0254..fb0d805 100644 --- a/eventlet/wsgi.py +++ b/eventlet/wsgi.py @@ -154,6 +154,12 @@ class Input(object): read = b'' self.position += len(read) return read + + def _discard_trailers(self, rfile): + while True: + line = rfile.readline() + if not line or line in (b'\r\n', b'\n', b''): + break def _chunked_read(self, rfile, length=None, use_readline=False): if self.should_send_hundred_continue: @@ -204,7 +210,7 @@ class Input(object): raise ChunkReadError(err) self.position = 0 if self.chunk_length == 0: - rfile.readline() + self._discard_trailers(rfile) except greenio.SSL.ZeroReturnError: pass return b''.join(response)