This vulnerability occurs when libevent processes HTTP chunked trailers by incorrectly merging them into request headers via evhttp_read_trailer. An unauthenticated remote attacker can inject security‑critical fields into those trailers. Because the library treats the merged trailers as regular headers, the attacker can alter the effective headers that the application and any upstream proxy see. This manipulation permits header smuggling, authorization bypass, proxy‑header spoofing, or cache poisoning, depending on how the target application interprets the headers. The weakness is classified as CWE‑444.

The issue affects the libevent library across all releases prior to 2.1.13 and 2.2.2‑alpha. Users that employ libevent 2.1.x older than 2.1.13 or libevent 2.2.x before 2.2.2‑alpha are vulnerable. Upstream projects or applications that link to these vulnerable versions and expose HTTP endpoints can be compromised.

The vulnerability scores a 6.3 on the CVSS base. An attacker does not need authentication or elevated privileges to exploit the flaw; they simply need to send an HTTP request that includes chunked transfer encoding trailers. The exploitation path is straightforward: compose a request that carries malicious trailer fields, deliver it to the target, and the library will translate them into actual request headers that the application processes. Because the flaw is not listed in CISA’s KEV catalog and no EPSS data is available, the overall exploitation probability is unclear but the vector and required control are minimal, warranting rapid mitigation.