Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
CVSS Details
- CVSS 4.0 Base Score: 6.3 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libevent-develUpgrade libevent-docUpgrade libevent | Oct 11, 2026 | Sep 16, 2026 |
| Debian | — | Upgrade libevent | Sep 21, 2026 | Aug 20, 2026 |
| Ibm Aix | — | Apply the fix or workaround for ntp_tmux_advisory15 | Oct 21, 2026 | Oct 21, 2026 |
| Oracle_linux | — | Upgrade libeventUpgrade libevent-develUpgrade libevent-doc | Oct 22, 2026 | Aug 20, 2026 |
| Redhat_linux | — | Upgrade libeventUpgrade libevent-develUpgrade libevent-debuginfoUpgrade libevent-docNo solution existsUpgrade libevent-debugsource | Aug 31, 2026 | Aug 20, 2026 |
| Rocky_linux | — | Upgrade libevent-debuginfoUpgrade libevent-develUpgrade libevent-debugsourceUpgrade libevent | Sep 18, 2026 | Sep 17, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub