CVE-2026-63379
Received Received - Intake

HTTP Header Smuggling in Libevent

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63379
EUVD
EUVD-2026-63562

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
libevent libevent to 2.1.13 (inc)
libevent libevent to 2.2.2-alpha (inc)
libevent libevent to 2.2.2-alpha (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63379 is a vulnerability in the libevent library where HTTP trailers were incorrectly merged into request headers during chunked HTTP requests. This violated HTTP specifications since trailers should not be treated as normal headers. The issue allowed unauthenticated remote attackers to manipulate headers, enabling attacks like header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning.

Detection Guidance

To detect this vulnerability, check the version of libevent installed on your system using commands like 'libevent-config --version' or 'dpkg -l | grep libevent' on Debian-based systems. If the version is 2.1.12 or earlier, or 2.2.1-alpha or earlier, the system is vulnerable. Network detection may involve monitoring HTTP traffic for improperly handled trailers or header smuggling attempts.

Impact Analysis

This vulnerability can lead to security breaches such as unauthorized access, data manipulation, or service disruption. Attackers could bypass authentication, spoof proxy headers, or poison caches, potentially exposing sensitive data or compromising system integrity. Systems using vulnerable libevent versions are at risk if they process chunked HTTP requests.

Compliance Impact

This vulnerability may violate compliance requirements by enabling unauthorized data access or manipulation, which could lead to breaches of confidentiality and integrity. Systems handling sensitive data under GDPR or HIPAA may fail to meet security standards if this issue is not addressed, potentially resulting in regulatory penalties or data exposure.

Mitigation Strategies

Immediately upgrade libevent to version 2.1.13 or 2.2.2-alpha or later. If upgrading is not possible, apply patches from the official libevent repository or disable services using libevent for HTTP processing. Monitor network traffic for signs of exploitation and update firewall rules to block suspicious header patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63379. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart