REDHAT-BUG-2520667: Medium severity libevent libevent vulnerability

Q: Which deployments are realistically exposed to this issue?

Deployments are exposed when a libevent-based HTTP application accepts chunked HTTP requests through an upstream proxy and relies on security-sensitive request headers. The risk arises when the proxy and application derive different effective headers from trailer fields.

Q: What does an attacker need to exploit it?

An unauthenticated remote attacker needs to be able to send a crafted chunked HTTP request containing trailer fields. No authentication requirement is described.

Q: Are affected trailer fields retained by the vulnerable application?

Yes. In affected versions, libevent merges parsed chunked HTTP trailers into the request input headers, allowing trailer values to influence the headers seen by the application.

Q: What changes in the fixed versions?

Versions 2.1.13 and 2.2.2-alpha parse trailers into a temporary header list and discard them rather than merging them into the request headers. Updating to one of those fixed versions removes the described trailer-to-header merging behavior.

Published Aug 20, 2026

Updated

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->inputheaders. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Affected Software

1 affected component

libevent libevent<2.1.13, <2.2.2-alpha

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libevent to a version that resolves this vulnerability.
Fixed in 2.1.13
Upgrade
Upgrade libevent to a version that resolves this vulnerability.
Fixed in 2.2.2-alpha

Event History

Aug 20, 2026

Data Sourced

via Red Hat·06:12 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

Deployments are exposed when a libevent-based HTTP application accepts chunked HTTP requests through an upstream proxy and relies on security-sensitive request headers. The risk arises when the proxy and application derive different effective headers from trailer fields.

What does an attacker need to exploit it?

An unauthenticated remote attacker needs to be able to send a crafted chunked HTTP request containing trailer fields. No authentication requirement is described.

Are affected trailer fields retained by the vulnerable application?

Yes. In affected versions, libevent merges parsed chunked HTTP trailers into the request input headers, allowing trailer values to influence the headers seen by the application.

What changes in the fixed versions?

Versions 2.1.13 and 2.2.2-alpha parse trailers into a temporary header list and discard them rather than merging them into the request headers. Updating to one of those fixed versions removes the described trailer-to-header merging behavior.

REDHAT-BUG-2520667: Medium severity libevent libevent vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What does an attacker need to exploit it?

Are affected trailer fields retained by the vulnerable application?

What changes in the fixed versions?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What does an attacker need to exploit it?

Are affected trailer fields retained by the vulnerable application?

What changes in the fixed versions?