VDB
RHSA-2026:1577
RHSA-2026:1577
PUBLISHED
CVSS 6.5 MEDIUM
A request smuggling flaw was found in the Eventlet PyPI library. The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability allows attackers to bypass front-end security controls, launch targeted attacks against active site users, and poison web caches.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-ironic-machine-os-downloader-rhel9@sha256:e9755353f700b29c76141c9d442274b56352820e3c60f84e21b7eca7214887b4_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, * |
| Red Hat | registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b1f5fcf03a366193f6a8248ab2b1704f908cd7a76565ebb96e5053879b6dc031_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-console-rhel9-operator@sha256:9c8e8fac35426b0b403db778b4b423560ccfb54c1607e2e05525b30713b30509_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-registry-rhel9@sha256:69ff1653fdb6c4ac0e7bb64062ff35e5f5a3b781bb9b47b6af521eb7d86aa35f_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-networkpolicy-rhel9@sha256:811dfab9f6dff57fda111aa7d1b46c542655e62f4ab7dc72071895788f8caee1_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-multus-networkpolicy-rhel9@sha256:811dfab9f6dff57fda111aa7d1b46c542655e62f4ab7dc72071895788f8caee1_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator@sha256:cc8b2d667eb7c10285912b8d21e8366197a317d88203320210346660224d2e4a_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-hyperkube-rhel9@sha256:ed072c43d1718fd09c438ebba768701951e3f0a8d4694b63ba1ba530b5a28da7_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-hyperkube-rhel9@sha256:ed072c43d1718fd09c438ebba768701951e3f0a8d4694b63ba1ba530b5a28da7_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:be1e88896c426600ba2cd23c687ed07ebc116dc3a89628323206e06de955d8a2_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:be1e88896c426600ba2cd23c687ed07ebc116dc3a89628323206e06de955d8a2_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:e1eb7648f032456e515b753a523203b63cbeef9c4ef6e802d14608cf0d6ffe08_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:e1eb7648f032456e515b753a523203b63cbeef9c4ef6e802d14608cf0d6ffe08_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-aws-pod-identity-webhook-rhel9@sha256:4721257ca7a1f3c32c9ecc5f37b7eac25c4886a462064b217702fd54f1bbf042_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-olm-operator-controller-rhel9@sha256:d234a0f7ed3bd0cd988f0b3a9320df5bcbfb212f176c362e749e7d4b56d62121_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-olm-operator-controller-rhel9@sha256:d234a0f7ed3bd0cd988f0b3a9320df5bcbfb212f176c362e749e7d4b56d62121_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-network-rhel9-operator@sha256:836d364e1ea13c6e2112c8397187744170eb2b0aff431f64e8922dca9b3d4b6e_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-cluster-network-rhel9-operator@sha256:836d364e1ea13c6e2112c8397187744170eb2b0aff431f64e8922dca9b3d4b6e_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:f4c9cf095d550e607af2cefac597d5ff50a66405d9f2a1443b51acd0b01a279e_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-attacher-rhel9@sha256:a3d45d435e7663d5cabb2d1f7f05111dac4965227f99d3afec9ab363b9727b9b_s390x as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-csi-external-attacher-rhel9@sha256:a3d45d435e7663d5cabb2d1f7f05111dac4965227f99d3afec9ab363b9727b9b_s390x, * |
| Red Hat | registry.redhat.io/openshift4/ose-prom-label-proxy-rhel9@sha256:e8b4a17fa64284af8f66f4f6d9e6e0cbb520eb96ca60466d0493499f7dc36234_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, registry.redhat.io/openshift4/ose-prom-label-proxy-rhel9@sha256:e8b4a17fa64284af8f66f4f6d9e6e0cbb520eb96ca60466d0493499f7dc36234_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9-operator@sha256:492f5a4b452460b01a36687675b85fc7c775459858ba60de26a1635dbf3a097c_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:16086130c4ba50f9059fe680f3cd876150941b697760796eaf7c2dde86c1e779_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:16086130c4ba50f9059fe680f3cd876150941b697760796eaf7c2dde86c1e779_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-configmap-reloader-rhel9@sha256:9c234ba3bd0b038635afec72e46ce4eb316b8abad4492d530f7f04cbdf2a15cd_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, registry.redhat.io/openshift4/ose-configmap-reloader-rhel9@sha256:9c234ba3bd0b038635afec72e46ce4eb316b8abad4492d530f7f04cbdf2a15cd_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9@sha256:0d47179d0efa7b4357468d4e8f78a6c6e02d33d2bd76ea3e403d704c29406b38_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9@sha256:0d47179d0efa7b4357468d4e8f78a6c6e02d33d2bd76ea3e403d704c29406b38_arm64, * |
| Red Hat | registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:8b34f1759f22f15fb0715d23eea678d78881d3af73abc73b3a53525afa926a9e_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:8b34f1759f22f15fb0715d23eea678d78881d3af73abc73b3a53525afa926a9e_arm64, * |
…and 638 more
Timeline
- Feb 4, 2026 CVE Published
- May 11, 2026 Security Advisory
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/security/updates/classification/ advisory
- https://www.cve.org/CVERecord?id=CVE-2025-58068 advisory
- https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/sirupsen/logrus/issues/1370 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory
- https://access.redhat.com/errata/RHSA-2026:1577 advisory
- https://access.redhat.com/security/cve/CVE-2025-58068 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1577.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2391958 issue
- https://nvd.nist.gov/vuln/detail/CVE-2025-58068 advisory
- https://github.com/eventlet/eventlet/pull/1062 advisory
- https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/pull/1376 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory
…and 2 more