Executive brief
Libevent is a widely-used event notification library that handles network communication for many applications. An attacker can exploit improper processing of HTTP trailer headers to trick upstream proxies and applications into interpreting different effective headers, potentially bypassing authorization checks, spoofing security-critical headers, poisoning caches, or gaining unauthorized access to protected resources.
Technical details
Libevent versions prior to 2.1.13 and 2.2.2-alpha incorrectly merge HTTP chunked transfer encoding trailers into the main request header list via the evhttp_read_trailer function in http.c. This violates HTTP specifications and creates a header interpretation mismatch: an upstream proxy and the libevent application may process different effective headers from the same request. An unauthenticated remote attacker can craft a malicious chunked HTTP request with security-sensitive fields in trailers to achieve header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The vulnerability is fixed by parsing trailers into a temporary list and discarding them instead of merging them. Patches are available in versions 2.1.13 and 2.2.2-alpha.
Affected products
- Libevent Libevent prior to 2.1.13 and 2.2.2-alpha
Timeline
- 2026-08-20: disclosed
- 2026: patched: Patched in versions 2.1.13 and 2.2.2-alpha