CVE-2026-63379: Libevent: HTTP Header smuggling
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->inputheaders. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.1.13 - Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.2.2-alpha
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using libevent versions earlier than 2.1.13 or 2.2.2-alpha are affected when they process HTTP requests with chunked trailers. The risk is particularly relevant where an upstream proxy and the libevent application may interpret request headers differently.
Does exploitation require authentication?
No. An unauthenticated remote attacker can send a chunked HTTP request containing security-sensitive fields in trailer headers.
What can an attacker achieve?
Because vulnerable libevent merges trailer fields into the request headers, an attacker may cause inconsistent effective headers between a proxy and the application. The described impacts include authorization bypass, proxy-header spoofing, cache poisoning, and header smuggling.
How is the issue fixed?
Upgrade to libevent 2.1.13 or 2.2.2-alpha. These versions parse trailers into a temporary header list and discard them rather than merging them into request input headers.