CVE-2026-63382
Received Received - Intake

HTTP Request Smuggling in Libevent

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63382
EUVD
EUVD-2026-63505

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
libevent libevent to 2.1.13 (inc)
libevent libevent to 2.2.2-alpha (inc)
libevent libevent to 2.1.13|end_excluding=2.2.2-alpha (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63382 is a vulnerability in the libevent library affecting HTTP request parsing. It involves inconsistent handling of Transfer-Encoding headers, duplicate headers, and chunked framing terminators. This allows attackers to desynchronize request boundaries and smuggle additional requests when libevent is used behind a proxy, potentially bypassing access controls or poisoning caches.

Detection Guidance

To detect this vulnerability, check if your libevent version is below 2.1.13 or 2.2.2-alpha. Use commands like 'libevent-config --version' or inspect package managers (e.g., 'apt list --installed | grep libevent' for Debian/Ubuntu). Monitor HTTP traffic for malformed Transfer-Encoding headers or chunked encoding issues.

Impact Analysis

This vulnerability enables HTTP request smuggling attacks. An unauthenticated remote attacker could bypass security controls, steal credentials, poison caches, hijack sessions, or desynchronize requests. It specifically exploits differences in how libevent and other proxies interpret malformed HTTP requests.

Compliance Impact

HTTP request smuggling can lead to unauthorized access, data breaches, or integrity violations. For GDPR, this may result in unauthorized data exposure. For HIPAA, it could compromise protected health information. Compliance requires patching to prevent such attacks.

Mitigation Strategies

Upgrade libevent to version 2.1.13 or 2.2.2-alpha immediately. If upgrading is not possible, disable HTTP proxy functionality or implement strict header validation at the network perimeter. Review and block requests with duplicate Transfer-Encoding headers or conflicting Content-Length/Transfer-Encoding combinations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63382. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart