Input validation error in libevent - #VU136952
Published: July 6, 2026
Vulnerability identifier: #VU136952
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to smuggle HTTP headers.
The vulnerability exists due to improper input validation in the evhttp_read_trailer function in http.c when processing HTTP trailer fields in chunked encoded requests. A remote attacker can send a specially crafted chunked HTTP request with malicious trailer headers to smuggle HTTP headers.
This can lead to request desynchronization, cache poisoning, access control bypass, or host header manipulation in deployments that trust or process the merged headers.
Affected software
libevent
Remediation
Install security update from vendor's website.
libevent - update to 2.1.13