Libevent contains two HTTP parsing weaknesses in http.c. One flaw allows percent-encoded %00 bytes to be decoded into literal NUL characters, which can truncate a path string and let an attacker bypass validation performed on a different representation. The other flaw accepts obsolete CRLF line folding in header values, enabling a proxy that uses libevent to interpret header values differently and permitting header injection or access control bypass. These weaknesses are linked to CWE-444.

The issue affects all installations of the libevent library earlier than version 2.1.13 stable and 2.2.2-alpha. Vulnerable builds include those delivered with the releases identified in the advisory references.

The vulnerability has a high CVSS score of 9.2, indicating severe impact. EPSS data is not currently available, and the vulnerability is not listed in the CISA KEV catalog. An attacker could craft HTTP requests containing %00 sequences or CRLF-folded headers to send to a server or proxy that employs an affected libevent build. This would likely be a remote, network-based attack that could lead to unauthorized access or control of protected resources, assuming the impacted application performs path or header validation that the attacker can subvert.