CyberRota Analysis
AI-GeneratedLibevent versions prior to 2.1.13 and 2.2.2-alpha are vulnerable to critical HTTP parsing flaws that can lead to header injection and access control bypass, as well as potential path truncation due to improper handling of percent-encoded NUL characters. This vulnerability poses a significant risk for applications relying on Libevent for HTTP processing, particularly those that do not validate input rigorously. Organizations utilizing affected versions should prioritize upgrading to the patched releases to mitigate these security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.