CVE-2026-63379
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Libevent before 2.1.13 and 2.2.2-alpha processes chunked HTTP trailers and merges them into request headers. An unauthenticated remote attacker can place security-sensitive fields in trailers, causing header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning.
Risk Assessment
The vulnerability enables header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning, potentially compromising data security.
Recommendation
Upgrade to version 2.1.13 or 2.2.2-alpha, which fix the issue by discarding trailers instead of merging them.
Other vulnerabilities in Libevent
See all- CVE-2016-10197High
The search_make_new function in evdns.c in libevent before version 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.
- CVE-2016-10196High
A stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before version 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.
- CVE-2015-6525High
Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta may allow attackers to cause a denial of service or possibly have other unspecified impact via 'insanely large inputs'.
- CVE-2014-6272High
Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via 'insanely large inputs'.
- CVE-2026-63385Critical
A vulnerability in Libevent before versions 2.1.13 and 2.2.2-alpha includes two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause path truncation and bypass validation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing CR or LF, allowing a proxy and libevent to interpret headers differently.
- CVE-2026-63382Critical
Libevent before versions 2.1.13 and 2.2.2-alpha inconsistently handles duplicate Transfer-Encoding headers, comma-separated values, and bare line feeds in chunked framing. This can lead to request desynchronization and request smuggling by an unauthenticated remote attacker when deployed behind a proxy.
- CVE-2016-10195Critical
The name_parse function in evdns.c in libevent before version 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, leading to an out-of-bounds stack read.
- CVE-2026-63495High
Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.
- CVE-2026-63388High
Libevent prior to 2.1.13 and 2.2.2-alpha has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
- CVE-2026-63387High
Libevent prior to 2.1.13 and 2.2.2-alpha has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Original NVD description (English source)
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.