AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 38 Bitcoin

http: switch servers from libevent to bitcoin

Public commit record

What the developer wrote

Authored by Matthew Zipkin

45/100 · Thin
http: switch servers from libevent to bitcoin
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
The short version

What changed, and why it matters

This commit replaces Bitcoin Core's long-standing libevent-based HTTP server with a new custom-built HTTP server. The change is architectural, not a targeted bug fix. It alters how the node parses and rejects HTTP requests, which could change which malformed requests are accepted or rejected. Because the new parser is fresh code handling network input, it introduces the possibility of new parsing bugs, request smuggling, or denial-of-service issues, but the diff itself does not contain an obvious exploit.

Recommended action

Treat this as a high-risk refactoring of network-facing code. Review the new `http_bitcoin` HTTP parser implementation (not shown in this diff) for request smuggling, integer overflow, buffer handling, and DoS resilience. Run fuzzing and the updated functional tests against the new server. Monitor for follow-up commits that remove the deprecated libevent path and verify no `Assume(false)` path becomes reachable.

Security signals we found

01

Large-scale HTTP parser rewrite replacing a mature external library (libevent) with custom parsing code

02

Changes to request rejection semantics (status codes, header whitespace handling, duplicate Content-Length handling)

03

Body size limit constant reduced/clarified from 0x02000000 to 32 MiB

04

Old libevent request callback left with an `Assume(false)` unreachable marker, indicating transitional state

05

Functional tests updated to expect stricter RFC-compliant behavior

Risk score

Why this scored 38/100

Our methodology →
Potential impact 8/30
Exploitability 7/25
Stealth signal 5/15
Affected reach 10/15
Confidence 5/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.