Access control bypass via HTTP parser mismatch

HTTP parser inconsistencies in Libevent http.c before 2.1.13 and 2.2.2-alpha allow remote attackers to bypass access controls. The evhttp_decode_uri_internal function decodes %00 into a literal NUL that downstream C string operations truncate, and evhttp_header_is_valid_value accepted CRLF-based obs-fold so a proxy and Libevent could parse the same header block differently. Exposure requires Libevent's HTTP handling to be reachable and for surrounding code or intermediaries to make security decisions on a different path or header interpretation, enabling restricted-path access or header-based policy bypass rather than direct code execution.