doc: add release note for #35182 replace libevent HTTP server
What the developer wrote
Authored by Matthew Zipkin
doc: add release note for #35182 replace libevent HTTP server
What changed, and why it matters
This commit only adds a release note document describing a previous HTTP server rewrite. It does not change any code, configuration, or behavior. There is no security issue in this commit itself.
No action needed; this is a documentation-only commit. Review the actual HTTP server implementation changes in PR #35182 separately if assessing security relevance of the rewrite.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit creates doc/release-notes-35182.md, a documentation-only file summarizing pull request #35182, which replaced Bitcoin Core’s libevent-based HTTP server with a custom implementation. The release note lists logging category deprecation and minor HTTP RFC compliance changes. No source code is modified.
Changed components
doc/release-notes-35182.mdInspect captured patch +16 / −0
diff --git a/doc/release-notes-35182.md b/doc/release-notes-35182.md
new file mode 100644
index 00000000..f28913ac
--- /dev/null
+++ b/doc/release-notes-35182.md
@@ -0,0 +1,16 @@
+HTTP: RPC / REST
+----------------
+
+The HTTP server has been rewritten from scratch to replace libevent. (#35182)
+
+`libevent` has been deprecated as a logging category and will be removed in
+a future release. At that time configurations like `debugexclude=libevent` will
+be invalid.
+
+Certain HTTP edge cases will observe different behavior to be more RFC-compliant:
+
+- Stricter enforcement of maximum headers size (8192 bytes)
+- Reject requests with whitespace in header field-names
+- "Line Folding" is rejected (whitespace at start of a header line)
+- Tolerate `%` at the end of requested URLs
+- Multiple "Content-Length" headers with different values are rejected
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.