Input validation error in libevent - #VU136948
Published: July 6, 2026
Vulnerability identifier: #VU136948
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to smuggle HTTP requests and disclose sensitive information.
The vulnerability exists due to improper input validation in chunked body parsing in evhttp when parsing chunked transfer coding with bare LF line terminators. A remote attacker can send a specially crafted chunked request using bare LF terminators to smuggle HTTP requests and disclose sensitive information.
Exploitation depends on parser differentials with an intermediary that strictly requires CRLF or otherwise interprets chunk boundaries differently.
Affected software
libevent
Remediation
Install security update from vendor's website.
libevent - addressed in versions 2.1.13, 7.0