VDB
RHSA-2026:1549
RHSA-2026:1549
PUBLISHED
CVSS 6.5 MEDIUM
A request smuggling flaw was found in the Eventlet PyPI library. The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability allows attackers to bypass front-end security controls, launch targeted attacks against active site users, and poison web caches.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-vsphere-cloud-controller-manager-rhel9@sha256:8cca8fae9fc034a3cfe91498d0b59a66aad3f8fb44ebc71154827fd212395baa_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | registry.redhat.io/openshift4/ose-vsphere-cloud-controller-manager-rhel9@sha256:8cca8fae9fc034a3cfe91498d0b59a66aad3f8fb44ebc71154827fd212395baa_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-alertmanager@sha256:a764f4393a8117d8760a7162f96435546dab72dc85ad7fc007b651e88d72c790_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | registry.redhat.io/openshift4/ose-prometheus-alertmanager@sha256:a764f4393a8117d8760a7162f96435546dab72dc85ad7fc007b651e88d72c790_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-baremetal-operator-rhel9@sha256:8c1bff341adcc88c1d60d875919bb255aacaedb3f0e9e4d8be406e402200cc94_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-snapshot-controller-rhel9@sha256:608fa7b0d0cbfd6e9be6aedd121446c648060c4578b0fea7ae54a82bbbb9aed6_s390x as a component of Red Hat OpenShift Container Platform 4.15 | *, registry.redhat.io/openshift4/ose-csi-snapshot-controller-rhel9@sha256:608fa7b0d0cbfd6e9be6aedd121446c648060c4578b0fea7ae54a82bbbb9aed6_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-installer@sha256:54e5faa9c9ec34027f02166c7ac9e59077e179f3ead4dc0dd4105791e02740ae_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | registry.redhat.io/openshift4/ose-installer@sha256:54e5faa9c9ec34027f02166c7ac9e59077e179f3ead4dc0dd4105791e02740ae_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-image-registry-rhel9-operator@sha256:65098acfce9f50191859afe19c5efefd93a49f9d30de04974dd7c40cedefae89_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-rbac-proxy@sha256:40e481c9eda5acafdddbd3e3a070ec9c36eb9e03694ba2c4b96736859e62cba5_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cli-artifacts@sha256:cb861b8429bdcc7195de58ef53b807720810ce8ccbe928c0ded61a6f3bf84a51_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | *, registry.redhat.io/openshift4/ose-cli-artifacts@sha256:cb861b8429bdcc7195de58ef53b807720810ce8ccbe928c0ded61a6f3bf84a51_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9@sha256:f6c99eaca89e098b9387265fce16291a88da64c214b4a78e17f017dcf3c95c61_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator@sha256:42602aba1b47f9231a10c3f33c976575f26e176dc8dd5c9a0853cc5bf80f93df_s390x as a component of Red Hat OpenShift Container Platform 4.15 | *, registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator@sha256:42602aba1b47f9231a10c3f33c976575f26e176dc8dd5c9a0853cc5bf80f93df_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:c324029e56c1e3594ba6ab1060bfa5237a0671a733215bcb57034d0127b3ddde_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | *, registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:c324029e56c1e3594ba6ab1060bfa5237a0671a733215bcb57034d0127b3ddde_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8@sha256:f33208db761719767675e40a166ff9655e00099a79c4b5124f133ce5e1a20512_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8@sha256:f33208db761719767675e40a166ff9655e00099a79c4b5124f133ce5e1a20512_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:7f42deee6d5ed50a9ed925346a4c14a65b80a635168113a1d14a7c30569432ee_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:7f42deee6d5ed50a9ed925346a4c14a65b80a635168113a1d14a7c30569432ee_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-snapshotter-rhel9@sha256:15afab05a84a3d47a491ec17efd1568120c72669534178fa6cb87c7543ce361a_arm64 as a component of Red Hat OpenShift Container Platform 4.15 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-storage-version-migrator-rhel9-operator@sha256:a07ffb825760e8e2b67b116099a9d4f9d00c5002dd6446697f19551c560254a9_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | registry.redhat.io/openshift4/ose-cluster-kube-storage-version-migrator-rhel9-operator@sha256:a07ffb825760e8e2b67b116099a9d4f9d00c5002dd6446697f19551c560254a9_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-provider-openstack-rhel9@sha256:a282fdd9e63e2eb52dbdb44aca2eaf0b4674a118daa4822662f4879d3a7a8481_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | *, registry.redhat.io/openshift4/ose-machine-api-provider-openstack-rhel9@sha256:a282fdd9e63e2eb52dbdb44aca2eaf0b4674a118daa4822662f4879d3a7a8481_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel9@sha256:24e0cf019ba5b461ccf4c621bba86fbbe7a6caeef947e1eb7238565e15a8971f_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel9@sha256:24e0cf019ba5b461ccf4c621bba86fbbe7a6caeef947e1eb7238565e15a8971f_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-platform-operators-manager-rhel9@sha256:ff5a8d57aec55e6127c9bf3f27b74b14eca5d555204122c9023ac52a74f57c1b_amd64 as a component of Red Hat OpenShift Container Platform 4.15 | registry.redhat.io/openshift4/ose-cluster-platform-operators-manager-rhel9@sha256:ff5a8d57aec55e6127c9bf3f27b74b14eca5d555204122c9023ac52a74f57c1b_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-attacher-rhel9@sha256:2da6c31c4e9e4c1d13b3182bd3457daa3d0b54a7d64360f1fd2c66d4e2c4bd80_s390x as a component of Red Hat OpenShift Container Platform 4.15 | *, registry.redhat.io/openshift4/ose-csi-external-attacher-rhel9@sha256:2da6c31c4e9e4c1d13b3182bd3457daa3d0b54a7d64360f1fd2c66d4e2c4bd80_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-runtimecfg-rhel9@sha256:d3f8be0a6e09fb88974b26c250fa54bde1d7c145840c46b5e7c67a6bb44bc63c_ppc64le as a component of Red Hat OpenShift Container Platform 4.15 | *, registry.redhat.io/openshift4/ose-baremetal-runtimecfg-rhel9@sha256:d3f8be0a6e09fb88974b26c250fa54bde1d7c145840c46b5e7c67a6bb44bc63c_ppc64le |
…and 640 more
Timeline
- Feb 5, 2026 CVE Published
- May 11, 2026 Distribution Patch
- May 11, 2026 Security Advisory
- May 11, 2026 Security Advisory
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:1549 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-58068 advisory
- https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb advisory
- https://github.com/eventlet/eventlet/pull/1062 advisory
- https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory
- https://access.redhat.com/security/cve/CVE-2025-58068 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1549.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2391958 issue
- https://www.cve.org/CVERecord?id=CVE-2025-58068 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/sirupsen/logrus/issues/1370 advisory
…and 2 more