The issue arises in the evhttp component of libevent, where the HTTP parser incorrectly handles duplicate Transfer‑Encoding headers, comma‑separated lists, and raw line feeds in chunked traffic. This type of weakness, classified as CWE‑444 – inadequate handling of HTTP chunked encoding, allows an attacker to desynchronize request boundaries and smuggle a second HTTP request within a single client connection. The smuggled request can bypass access controls or poison shared HTTP caches, leading to unauthorized access or data leakage.

libevent’s evhttp parser is affected in all releases before 2.1.13 and before the 2.2.2‑alpha branch. The fix is included in libevent release‑2.1.13‑stable and the 2.2.2‑alpha release.

The CVSS score of 9.2 classifies this as high severity, and the vulnerability is exploitable by an unauthenticated remote attacker positioned behind a proxy or load balancer that frames requests. Because EPSS is not available and the issue is not listed in the CISA KEV catalog, the likelihood of observed attacks remains uncertain, but the potential impact warrants prompt remediation. The attack vector is inferred to be HTTP request smuggling along the network path between the client and the server.