CyberRota Analysis
AI-GeneratedLibevent versions prior to 2.1.13 and 2.2.2-alpha are vulnerable to header smuggling, authorization bypass, proxy-header spoofing, and cache poisoning due to improper processing of chunked HTTP trailers. An unauthenticated remote attacker can exploit this vulnerability to manipulate request headers, leading to potential security breaches. Organizations using affected versions of Libevent should prioritize upgrading to the fixed versions to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.