CVE-2026-63385
Received Received - Intake

HTTP Request Smuggling in Libevent Library

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63385
EUVD
EUVD-2026-63563

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libevent libevent to 2.1.13|end_excluding=2.2.2-alpha (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Libevent library's HTTP parsing functions. It involves two issues: 1) URI decoding converts %00 to a literal NUL byte, truncating paths and bypassing access controls. 2) Libevent accepts obsolete header line folding (CRLF) which can enable header injection in proxy chains. The library versions before 2.1.13 and 2.2.2-alpha are affected.

Detection Guidance

To detect this vulnerability, check the version of libevent installed on your system. Run: libevent_version or check package managers like apt list --installed | grep libevent or rpm -qa | grep libevent. If the version is below 2.1.13 or 2.2.2-alpha, the system is vulnerable.

Impact Analysis

An attacker could exploit these flaws to bypass access controls by truncating URIs with %00 or inject malicious headers via CRLF in proxy chains. This may allow unauthorized access to restricted resources or manipulate server responses.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. The NUL byte URI truncation allows bypassing access controls, potentially exposing protected health or personal information. Header injection risks may also lead to data leaks or unauthorized modifications.

Mitigation Strategies

Upgrade libevent to version 2.1.13 or 2.2.2-alpha or later. If upgrading is not immediately possible, apply patches from the official libevent repository or disable HTTP header parsing features that may be affected by these issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart