AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 28 Bitcoin

cli: Remove libevent usage

Public commit record

What the developer wrote

Authored by Fabian Jahr

50/100 · Thin
cli: Remove libevent usage

This also removes the now-unused raii_evhttp_{request,connection}
helpers from support/events.h.
✓ Descriptive subject✓ Provides an explanatory body
The short version

What changed, and why it matters

This commit replaces the HTTP client library used by bitcoin-cli (libevent) with a new custom-built HTTP client. It is a large refactoring change that touches network communication, credential handling, and error messages. There is no direct evidence in the commit that this fixes a known security bug, but any rewrite of network and authentication code carries a risk of introducing subtle bugs in how bitcoin-cli talks to the Bitcoin server.

Recommended action

Treat this as a high-risk refactoring commit. Review the new HTTPClient implementation for parser bugs (e.g., chunked encoding edge cases, header injection, integer overflows in content-length/chunk-size handling), timeout behavior, and correct propagation of authentication errors. Run the updated functional tests and consider additional fuzzing or manual testing of malformed HTTP responses against bitcoin-cli.

Security signals we found

01

Large rewrite of RPC client network stack (libevent removal, custom HTTP parser)

02

Custom HTTP response parsing now handles status line, Content-Length, and chunked encoding

03

Authorization header construction moved from libevent evkeyvalq to manual string building

04

Connection timeout and retry logic rewritten

05

Wallet endpoint URL encoding changed from evhttp_uriencode to UrlEncode helper

06

No explicit security bug fix or vulnerability disclosure in commit message or diff

Risk score

Why this scored 28/100

Our methodology →
Potential impact 5/30
Exploitability 5/25
Stealth signal 5/15
Affected reach 5/15
Confidence 5/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.