CVE-2026-63382: libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first header, evhttpchecktransferencoding was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttphandlechunkedread uses EVBUFFEREOLCRLF rather than EVBUFFEREOLCRLFSTRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.1.13 - Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.2.2-alpha
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Deployments using libevent's evhttp parser behind a proxy are exposed when the proxy and evhttp can frame the same HTTP request differently. This parser disagreement can let a remote attacker desynchronize request boundaries.
Does exploitation require authentication or prior access?
No. An unauthenticated remote attacker can exploit the issue by sending HTTP requests that trigger the inconsistent handling of Transfer-Encoding headers or chunked framing.
What can happen if exploitation succeeds?
An attacker may smuggle a second request after desynchronizing request boundaries. The reported impacts include bypassing access controls and poisoning caches.
What versions contain the fix?
The issue is fixed in libevent 2.1.13 and 2.2.2-alpha. Versions prior to those releases are affected.