Eventlet affected by HTTP request smuggling in unparsed trailers

The Eventlet WSGI parser, used in Eventlet versions prior to 0.40.3, improperly handles HTTP trailer sections in chunked transfer encoding. When parsing the final chunk (length 0), the parser only reads a single line after the chunk, leaving remaining trailer data in the buffer. This incomplete parsing enables HTTP request smuggling attacks [1][3].

An attacker can exploit this by sending a crafted HTTP request that uses trailers to inject content that will be interpreted as part of the next request. The attack requires the ability to send HTTP requests to an Eventlet-based WSGI server; no authentication is needed beyond network access. The smuggled content may bypass front-end security controls such as web application firewalls or access control lists [1].

The impact includes cache poisoning, where an attacker can cause a shared cache to associate a benign URL with malicious content, affecting other users. It also enables session hijacking or other targeted attacks against active users by injecting malicious responses. The vulnerability is similar to a known smuggling issue in aiohttp [3].

A fix was implemented in commit 0bfebd1 and released in Eventlet 0.40.3. The fix discards all HTTP trailers after the final chunk, which is a breaking change if a backend behind an eventlet.wsgi proxy relies on receiving trailers. As a workaround, administrators should avoid using eventlet.wsgi with untrusted clients [1][4].